AGENT-1570: Remove all NoRegistryClusterInstall feature gate check

The InternalReleaseImage(IRI) functionality will now be always active instead of being gated behind a feature flag

Author: pawanpinjarkar

cmd/machine-config-controller/start.go

@@ -8,8 +8,6 @@ import (
 	"path"
 	"time"
 
-	features "github.com/openshift/api/features"
-	mcfginformersv1 "github.com/openshift/client-go/machineconfiguration/informers/externalversions/machineconfiguration/v1"
 	"github.com/openshift/machine-config-operator/cmd/common"
 	"github.com/openshift/machine-config-operator/internal/clients"
 	bootimagecontroller "github.com/openshift/machine-config-operator/pkg/controller/bootimage"
@@ -29,7 +27,6 @@ import (
 	"github.com/openshift/machine-config-operator/pkg/version"
 	"github.com/spf13/cobra"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	coreinformersv1 "k8s.io/client-go/informers/core/v1"
 	"k8s.io/client-go/tools/leaderelection"
 	"k8s.io/klog/v2"
 )
@@ -214,25 +211,23 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 
 		close(ctrlctx.InformersStarted)
 
-		if ctrlctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-			iriController := internalreleaseimage.New(
-				ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
-				ctrlctx.InformerFactory.Machineconfiguration().V1().ControllerConfigs(),
-				ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigs(),
-				ctrlctx.ConfigInformerFactory.Config().V1().ClusterVersions(),
-				ctrlctx.KubeInformerFactory.Core().V1().Secrets(),
-				ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigNodes(),
-				ctrlctx.KubeInformerFactory.Core().V1().Nodes(),
-				ctrlctx.ConfigInformerFactory.Config().V1().Infrastructures(),
-				ctrlctx.ClientBuilder.KubeClientOrDie("internalreleaseimage-controller"),
-				ctrlctx.ClientBuilder.MachineConfigClientOrDie("internalreleaseimage-controller"))
+		iriController := internalreleaseimage.New(
+			ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
+			ctrlctx.InformerFactory.Machineconfiguration().V1().ControllerConfigs(),
+			ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigs(),
+			ctrlctx.ConfigInformerFactory.Config().V1().ClusterVersions(),
+			ctrlctx.KubeInformerFactory.Core().V1().Secrets(),
+			ctrlctx.InformerFactory.Machineconfiguration().V1().MachineConfigNodes(),
+			ctrlctx.KubeInformerFactory.Core().V1().Nodes(),
+			ctrlctx.ConfigInformerFactory.Config().V1().Infrastructures(),
+			ctrlctx.ClientBuilder.KubeClientOrDie("internalreleaseimage-controller"),
+			ctrlctx.ClientBuilder.MachineConfigClientOrDie("internalreleaseimage-controller"))
 
-			go iriController.Run(ctx, 2)
-			// start the informers again to enable feature gated types.
-			// see comments in SharedInformerFactory interface.
-			ctrlctx.InformerFactory.Start(ctx.Done())
-			ctrlctx.KubeInformerFactory.Start(ctx.Done())
-		}
+		go iriController.Run(ctx, 2)
+		// start the informers again to pick up newly registered types.
+		// see comments in SharedInformerFactory interface.
+		ctrlctx.InformerFactory.Start(ctx.Done())
+		ctrlctx.KubeInformerFactory.Start(ctx.Done())
 
 		if ctrlcommon.IsBootImageControllerRequired(ctrlctx) {
 			bootImageController := bootimagecontroller.New(
@@ -290,17 +285,6 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 }
 
 func createControllers(ctx *ctrlcommon.ControllerContext, inspectionCache *imageutils.FileInspectionCache, inspectorFactory osimagestream.ImagesInspectorFactory) []ctrlcommon.Controller {
-	// Only watch IRI informers when the feature gate is enabled. The
-	// InternalReleaseImages CRD is not installed on clusters where the gate is
-	// off, so the informer list call would fail and WaitForCacheSync in the
-	// template controller would block forever.
-	var iriSecretsInformer coreinformersv1.SecretInformer
-	var iriInformer mcfginformersv1.InternalReleaseImageInformer
-	if ctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-		iriSecretsInformer = ctx.KubeInformerFactory.Core().V1().Secrets()
-		iriInformer = ctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages()
-	}
-
 	renderCtrl := render.New(
 		ctx.InformerFactory.Machineconfiguration().V1().MachineConfigPools(),
 		ctx.InformerFactory.Machineconfiguration().V1().MachineConfigs(),
@@ -331,8 +315,8 @@ func createControllers(ctx *ctrlcommon.ControllerContext, inspectionCache *image
 			rootOpts.templates,
 			ctx.InformerFactory.Machineconfiguration().V1().ControllerConfigs(),
 			ctx.OpenShiftConfigKubeNamespacedInformerFactory.Core().V1().Secrets(),
-			iriSecretsInformer,
-			iriInformer,
+			ctx.KubeInformerFactory.Core().V1().Secrets(),
+			ctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
 			ctx.ConfigInformerFactory.Config().V1().APIServers(),
 			ctx.ClientBuilder.KubeClientOrDie("template-controller"),
 			ctx.ClientBuilder.MachineConfigClientOrDie("template-controller"),

cmd/machine-config-daemon/start.go

@@ -12,7 +12,6 @@ import (
 	"k8s.io/apimachinery/pkg/api/resource"
 	"k8s.io/client-go/tools/clientcmd"
 
-	"github.com/openshift/api/features"
 	"github.com/openshift/machine-config-operator/internal/clients"
 	ctrlcommon "github.com/openshift/machine-config-operator/pkg/controller/common"
 	"github.com/openshift/machine-config-operator/pkg/daemon"
@@ -236,27 +235,21 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 	)
 	go pinnedImageSetManager.Run(2, stopCh)
 
-	var mcnScopedInformerStartFunc func(<-chan struct{})
-	if ctrlctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-		mcnScopedInformer, startFunc := ctrlcommon.NewScopedMachineConfigNodeInformerFromClientBuilder(cb, startOpts.nodeName)
-		mcnScopedInformerStartFunc = startFunc
-		internalReleaseImageManager := internalreleaseimage.New(
-			startOpts.nodeName,
-			ctrlctx.ClientBuilder.MachineConfigClientOrDie(componentName),
-			ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
-			mcnScopedInformer,
-		)
-		go internalReleaseImageManager.Run(1, stopCh)
-	}
+	mcnScopedInformer, mcnScopedInformerStartFunc := ctrlcommon.NewScopedMachineConfigNodeInformerFromClientBuilder(cb, startOpts.nodeName)
+	internalReleaseImageManager := internalreleaseimage.New(
+		startOpts.nodeName,
+		ctrlctx.ClientBuilder.MachineConfigClientOrDie(componentName),
+		ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
+		mcnScopedInformer,
+	)
+	go internalReleaseImageManager.Run(1, stopCh)
 
 	ctrlctx.KubeInformerFactory.Start(stopCh)
 	ctrlctx.KubeNamespacedInformerFactory.Start(stopCh)
 	ctrlctx.InformerFactory.Start(stopCh)
 	ctrlctx.OperatorInformerFactory.Start(stopCh)
 	nodeScopedInformerStartFunc(ctrlctx.Stop)
-	if mcnScopedInformerStartFunc != nil {
-		mcnScopedInformerStartFunc(ctrlctx.Stop)
-	}
+	mcnScopedInformerStartFunc(ctrlctx.Stop)
 	close(ctrlctx.InformersStarted)
 
 	if err := dn.Run(stopCh, exitCh, errCh); err != nil {

cmd/machine-config-operator/start.go

@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"os"
 
-	features "github.com/openshift/api/features"
 	"github.com/openshift/machine-config-operator/cmd/common"
 	"github.com/openshift/machine-config-operator/internal/clients"
 	ctrlcommon "github.com/openshift/machine-config-operator/pkg/controller/common"
@@ -67,13 +66,6 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 			klog.Fatal(fmt.Errorf("failed to connect to feature gates %w", fgErr))
 		}
 
-		// Only pass IRI informer when the feature gate is enabled to avoid
-		// watching for a CRD that may not exist
-		var iriInformer = ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages()
-		if !ctrlctx.FeatureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-			iriInformer = nil
-		}
-
 		controller := operator.New(
 			ctrlcommon.MCONamespace, componentName,
 			startOpts.imagesFile,
@@ -117,7 +109,7 @@ func runStartCmd(_ *cobra.Command, _ []string) {
 			ctrlctx.ConfigInformerFactory.Config().V1().ClusterVersions(),
 			ctrlctx.InformerFactory.Machineconfiguration().V1().OSImageStreams(),
 			ctrlctx.KubeNamespacedInformerFactory.Networking().V1().NetworkPolicies(),
-			iriInformer,
+			ctrlctx.InformerFactory.Machineconfiguration().V1().InternalReleaseImages(),
 			ctrlctx,
 		)
 

pkg/controller/bootstrap/bootstrap.go

@@ -27,7 +27,7 @@ import (
 	"github.com/opencontainers/go-digest"
 	apicfgv1 "github.com/openshift/api/config/v1"
 	apicfgv1alpha1 "github.com/openshift/api/config/v1alpha1"
-	"github.com/openshift/api/features"
+
 	imagev1 "github.com/openshift/api/image/v1"
 	mcfgv1 "github.com/openshift/api/machineconfiguration/v1"
 	mcfgv1alpha1 "github.com/openshift/api/machineconfiguration/v1alpha1"
@@ -280,7 +280,7 @@ func (b *Bootstrap) Run(destDir string) error {
 	// The template controller has not yet run at this point, so machine-config-daemon-pull.service
 	// would otherwise fail to authenticate against the IRI registry.
 	// Merge is a no-op if the feature gate is off or the IRI resource is absent.
-	merger := ctrlcommon.NewIRISecretMergerFromObjects(iriCredentialsSecret, cconfig, fgHandler, iri)
+	merger := ctrlcommon.NewIRISecretMergerFromObjects(iriCredentialsSecret, cconfig, iri)
 	pullSecretBytes, err = merger.Merge(pullSecretBytes)
 	if err != nil {
 		return fmt.Errorf("could not merge IRI credentials into pull secret for bootstrap: %w", err)
@@ -346,15 +346,13 @@ func (b *Bootstrap) Run(destDir string) error {
 	}
 	klog.Infof("Successfully generated MachineConfigs from kubelet configs.")
 
-	if fgHandler != nil && fgHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-		if iri {
-			iriConfigs, err := internalreleaseimage.RunInternalReleaseImageBootstrap(iriTLSCert, iriCredentialsSecret, cconfig)
-			if err != nil {
-				return err
-			}
-			configs = append(configs, iriConfigs...)
-			klog.Infof("Successfully generated MachineConfig from InternalReleaseImage.")
+	if iri {
+		iriConfigs, err := internalreleaseimage.RunInternalReleaseImageBootstrap(iriTLSCert, iriCredentialsSecret, cconfig)
+		if err != nil {
+			return err
 		}
+		configs = append(configs, iriConfigs...)
+		klog.Infof("Successfully generated MachineConfig from InternalReleaseImage.")
 	}
 
 	// Create component MachineConfigs for pre-built images for hybrid OCL

pkg/controller/certrotation/certrotation_controller.go

@@ -503,11 +503,6 @@ func (c *CertRotationController) reconcileSecret(secret corev1.Secret) error {
 }
 
 func (c *CertRotationController) reconcileIRICertificate() {
-	if !c.featureGatesHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-		klog.V(4).Infof("Skipping IRI certificate reconciliation: %s feature gate is not enabled", features.FeatureGateNoRegistryClusterInstall)
-		return
-	}
-
 	// Check that the IRI cluster resource exists to confirm the feature is actually enabled
 	if _, err := c.mcfgClient.MachineconfigurationV1().InternalReleaseImages().Get(context.TODO(), ctrlcommon.InternalReleaseImageInstanceName, metav1.GetOptions{}); err != nil {
 		if k8serrors.IsNotFound(err) {

pkg/controller/certrotation/certrotation_controller_test.go

@@ -18,7 +18,6 @@ import (
 	"github.com/openshift/library-go/pkg/crypto"
 	"github.com/openshift/library-go/pkg/operator/certrotation"
 	corev1 "k8s.io/api/core/v1"
-	k8serrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/sets"
 
@@ -120,10 +119,7 @@ func (f *fixture) newController() *CertRotationController {
 		f.infraLister = append(f.infraLister, infra.(*configv1.Infrastructure))
 	}
 
-	fgHandler := ctrlcommon.NewFeatureGatesHardcodedHandler(
-		[]configv1.FeatureGateName{features.FeatureGateNoRegistryClusterInstall},
-		nil,
-	)
+	fgHandler := ctrlcommon.NewFeatureGatesHardcodedHandler(nil, nil)
 	c, err := New(f.kubeClient, f.configClient, f.machineClient, f.aroClient, f.k8sI.Core().V1().Secrets(), f.k8sI.Core().V1().Secrets(), f.k8sI.Core().V1().ConfigMaps(), f.infraInformer.Config().V1().Infrastructures(), nil, fgHandler, f.mcfgClient)
 	require.NoError(f.t, err)
 
@@ -443,39 +439,6 @@ func TestIRICertificateRotation(t *testing.T) {
 	})
 }
 
-func TestIRICertificateReconcileSkippedWhenFeatureGateDisabled(t *testing.T) {
-	f := newFixture(t)
-	f.mcfgObjects = append(f.mcfgObjects, getIRIClusterResource())
-	f.machineObjects = append(f.machineObjects, getMachineSet("test-machine"))
-
-	// Build a controller with the feature gate disabled.
-	f.kubeClient = fake.NewSimpleClientset(f.objects...)
-	f.configClient = fakeconfigv1client.NewSimpleClientset(f.configObjects...)
-	f.machineClient = fakemachineclientset.NewSimpleClientset(f.machineObjects...)
-	f.mcfgClient = fakemcfgclientset.NewSimpleClientset(f.mcfgObjects...)
-	f.aroClient = fakearoclientset.NewSimpleClientset(f.aroObjects...)
-	f.k8sI = kubeinformers.NewSharedInformerFactory(f.kubeClient, noResyncPeriodFunc())
-	f.infraInformer = configinformers.NewSharedInformerFactory(f.configClient, noResyncPeriodFunc())
-
-	fgHandler := ctrlcommon.NewFeatureGatesHardcodedHandler(
-		nil,
-		[]configv1.FeatureGateName{features.FeatureGateNoRegistryClusterInstall},
-	)
-	c, err := New(f.kubeClient, f.configClient, f.machineClient, f.aroClient,
-		f.k8sI.Core().V1().Secrets(), f.k8sI.Core().V1().Secrets(),
-		f.k8sI.Core().V1().ConfigMaps(), f.infraInformer.Config().V1().Infrastructures(),
-		nil, fgHandler, f.mcfgClient)
-	require.NoError(t, err)
-
-	// reconcileIRICertificate must be a no-op when the feature gate is disabled.
-	c.reconcileIRICertificate()
-
-	// Verify no IRI TLS secret was created.
-	_, err = f.kubeClient.CoreV1().Secrets(ctrlcommon.MCONamespace).Get(context.TODO(), ctrlcommon.InternalReleaseImageTLSSecretName, metav1.GetOptions{})
-	require.Error(t, err, "IRI TLS secret should not exist when feature gate is disabled")
-	require.True(t, k8serrors.IsNotFound(err))
-}
-
 func TestNewWithConfigurablePKI(t *testing.T) {
 	testCases := []struct {
 		name           string
@@ -527,7 +490,7 @@ func TestNewWithConfigurablePKI(t *testing.T) {
 			}
 			infraInformer.Config().V1().Infrastructures().Informer().GetIndexer().Add(infraObj)
 
-			enabledGates := []configv1.FeatureGateName{features.FeatureGateNoRegistryClusterInstall}
+			var enabledGates []configv1.FeatureGateName
 			if tc.enablePKI {
 				enabledGates = append(enabledGates, features.FeatureGateConfigurablePKI)
 			}

pkg/controller/common/iri_secret_merger.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"strings"
 
-	features "github.com/openshift/api/features"
 	mcfgv1 "github.com/openshift/api/machineconfiguration/v1"
 	mcfglistersv1 "github.com/openshift/client-go/machineconfiguration/listers/machineconfiguration/v1"
 	corev1 "k8s.io/api/core/v1"
@@ -16,10 +15,9 @@ import (
 	"k8s.io/klog/v2"
 )
 
-// errIRIDisabled is returned by resolve when the NoRegistryClusterInstall
-// feature gate is off or the InternalReleaseImage resource is absent.
-// Merge treats it as a skip signal rather than an error.
-var errIRIDisabled = errors.New("IRI not enabled or not present")
+// errIRIDisabled is returned by resolve when the InternalReleaseImage
+// resource is absent. Merge treats it as a skip signal rather than an error.
+var errIRIDisabled = errors.New("IRI not present")
 
 // IRISecretMerger merges IRI registry credentials into a pull secret.
 // Construct via NewIRISecretMerger (controller use) or NewIRISecretMergerFromObjects
@@ -30,21 +28,16 @@ type IRISecretMerger struct {
 	resolve func() (password, baseDomain string, err error)
 }
 
-// NewIRISecretMerger creates an IRISecretMerger that resolves the feature gate,
+// NewIRISecretMerger creates an IRISecretMerger that resolves the
 // IRI resource, credentials secret, and ControllerConfig from the informer cache
 // at merge time. Use this in controllers where informers are available.
-// fgHandler must not be nil.
 func NewIRISecretMerger(
 	secretLister corelistersv1.SecretLister,
 	ccLister mcfglistersv1.ControllerConfigLister,
 	iriLister mcfglistersv1.InternalReleaseImageLister,
-	fgHandler FeatureGatesHandler,
 ) *IRISecretMerger {
 	return &IRISecretMerger{
 		resolve: func() (string, string, error) {
-			if !fgHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-				return "", "", errIRIDisabled
-			}
 			_, err := iriLister.Get(InternalReleaseImageInstanceName)
 			if apierrors.IsNotFound(err) {
 				return "", "", errIRIDisabled
@@ -67,19 +60,15 @@ func NewIRISecretMerger(
 
 // NewIRISecretMergerFromObjects creates an IRISecretMerger from pre-fetched objects.
 // Use this during bootstrap where informer caches are not yet available.
-// The feature gate and iri checks are deferred to Merge time so the constructor
-// never returns an error; if either check fails, Merge skips and logs.
+// The iri check is deferred to Merge time so the constructor
+// never returns an error; if the check fails, Merge skips and logs.
 func NewIRISecretMergerFromObjects(
 	secret *corev1.Secret,
 	cconfig *mcfgv1.ControllerConfig,
-	fgHandler FeatureGatesHandler,
 	iri bool,
 ) *IRISecretMerger {
 	return &IRISecretMerger{
 		resolve: func() (string, string, error) {
-			if fgHandler == nil || !fgHandler.Enabled(features.FeatureGateNoRegistryClusterInstall) {
-				return "", "", errIRIDisabled
-			}
 			if !iri {
 				return "", "", errIRIDisabled
 			}
@@ -91,12 +80,12 @@ func NewIRISecretMergerFromObjects(
 // Merge merges IRI registry credentials into pullSecretRaw, adding auth entries
 // for api-int.<baseDomain>:<IRIRegistryPort> (all nodes) and
 // localhost:<IRIRegistryPort> (masters, where the registry runs locally).
-// If the feature gate is disabled or the InternalReleaseImage resource is absent,
-// Merge logs and returns pullSecretRaw unchanged.
+// If the InternalReleaseImage resource is absent, Merge logs and returns
+// pullSecretRaw unchanged.
 func (m *IRISecretMerger) Merge(pullSecretRaw []byte) ([]byte, error) {
 	password, baseDomain, err := m.resolve()
 	if errors.Is(err, errIRIDisabled) {
-		klog.V(4).Info("Skipping IRI registry credential merge: IRI not enabled or not present")
+		klog.V(4).Info("Skipping IRI registry credential merge: IRI not present")
 		return pullSecretRaw, nil
 	}
 	if err != nil {