WIP: OKD-259: Support an "OKD" featureset to be enabled by default on OKD clusters

config/v1/tests/featuregates.config.openshift.io/AAA_ungated.yaml

@@ -29,7 +29,7 @@ tests:
         kind: FeatureGate
         spec:
           featureSet: bar
-      expectedError: "spec.featureSet: Unsupported value: \"bar\": supported values: \"CustomNoUpgrade\", \"DevPreviewNoUpgrade\", \"TechPreviewNoUpgrade\", \"\""
+      expectedError: "spec.featureSet: Unsupported value: \"bar\": supported values: \"CustomNoUpgrade\", \"DevPreviewNoUpgrade\", \"TechPreviewNoUpgrade\", \"OKD\", \"\""
   onUpdate:
     - name: Default to TechPreview
       initial: |
@@ -121,4 +121,4 @@ tests:
         kind: FeatureGate
         spec:
           featureSet: "bar"
-      expectedError: "spec.featureSet: Unsupported value: \"bar\": supported values: \"CustomNoUpgrade\", \"DevPreviewNoUpgrade\", \"TechPreviewNoUpgrade\", \"\""
+      expectedError: "spec.featureSet: Unsupported value: \"bar\": supported values: \"CustomNoUpgrade\", \"DevPreviewNoUpgrade\", \"TechPreviewNoUpgrade\", \"OKD\", \"\""

config/v1/types_feature.go

@@ -53,8 +53,12 @@ var (
 	// your cluster may fail in an unrecoverable way.
 	CustomNoUpgrade FeatureSet = "CustomNoUpgrade"
 
+	// OKD turns on features for OKD. Turning this feature set ON is supported for OKD clusters, but NOT for OpenShift clusters
+	// this feature set on CANNOT BE UNDONE for OKD clusters and when enabled on OpenShift clusters it PREVENTS UPGRADES.
+	OKD FeatureSet = "OKD"
+
 	// AllFixedFeatureSets are the featuresets that have known featuregates.  Custom doesn't for instance.  LatencySensitive is dead
-	AllFixedFeatureSets = []FeatureSet{Default, TechPreviewNoUpgrade, DevPreviewNoUpgrade}
+	AllFixedFeatureSets = []FeatureSet{Default, TechPreviewNoUpgrade, DevPreviewNoUpgrade, OKD}
 )
 
 type FeatureGateSpec struct {
@@ -67,10 +71,11 @@ type FeatureGateSelection struct {
 	// Turning on or off features may cause irreversible changes in your cluster which cannot be undone.
 	// +unionDiscriminator
 	// +optional
-	// +kubebuilder:validation:Enum=CustomNoUpgrade;DevPreviewNoUpgrade;TechPreviewNoUpgrade;""
+	// +kubebuilder:validation:Enum=CustomNoUpgrade;DevPreviewNoUpgrade;TechPreviewNoUpgrade;OKD;""
 	// +kubebuilder:validation:XValidation:rule="oldSelf == 'CustomNoUpgrade' ? self == 'CustomNoUpgrade' : true",message="CustomNoUpgrade may not be changed"
 	// +kubebuilder:validation:XValidation:rule="oldSelf == 'TechPreviewNoUpgrade' ? self == 'TechPreviewNoUpgrade' : true",message="TechPreviewNoUpgrade may not be changed"
 	// +kubebuilder:validation:XValidation:rule="oldSelf == 'DevPreviewNoUpgrade' ? self == 'DevPreviewNoUpgrade' : true",message="DevPreviewNoUpgrade may not be changed"
+	// +kubebuilder:validation:XValidation:rule="oldSelf == 'OKD' ? self == 'OKD' : true",message="OKD may not be changed"
 	FeatureSet FeatureSet `json:"featureSet,omitempty"`
 
 	// customNoUpgrade allows the enabling or disabling of any feature. Turning this feature set on IS NOT SUPPORTED, CANNOT BE UNDONE, and PREVENTS UPGRADES.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_featuregates.crd.yaml

@@ -79,6 +79,7 @@ spec:
                 - CustomNoUpgrade
                 - DevPreviewNoUpgrade
                 - TechPreviewNoUpgrade
+                - OKD
                 - ""
                 type: string
                 x-kubernetes-validations:
@@ -91,6 +92,8 @@ spec:
                 - message: DevPreviewNoUpgrade may not be changed
                   rule: 'oldSelf == ''DevPreviewNoUpgrade'' ? self == ''DevPreviewNoUpgrade''
                     : true'
+                - message: OKD may not be changed
+                  rule: 'oldSelf == ''OKD'' ? self == ''OKD'' : true'
             type: object
             x-kubernetes-validations:
             - message: .spec.featureSet cannot be removed

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_images-OKD.crd.yaml

@@ -0,0 +1,183 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  annotations:
+    api-approved.openshift.io: https://github.com/openshift/api/pull/470
+    api.openshift.io/merged-by-featuregates: "true"
+    include.release.openshift.io/ibm-cloud-managed: "true"
+    include.release.openshift.io/self-managed-high-availability: "true"
+    release.openshift.io/bootstrap-required: "true"
+    release.openshift.io/feature-set: OKD
+  name: images.config.openshift.io
+spec:
+  group: config.openshift.io
+  names:
+    kind: Image
+    listKind: ImageList
+    plural: images
+    singular: image
+  scope: Cluster
+  versions:
+  - name: v1
+    schema:
+      openAPIV3Schema:
+        description: |-
+          Image governs policies related to imagestream imports and runtime configuration
+          for external registries. It allows cluster admins to configure which registries
+          OpenShift is allowed to import images from, extra CA trust bundles for external
+          registries, and policies to block or allow registry hostnames.
+          When exposing OpenShift's image registry to the public, this also lets cluster
+          admins specify the external hostname.
+
+          Compatibility level 1: Stable within a major release for a minimum of 12 months or 3 minor releases (whichever is longer).
+        properties:
+          apiVersion:
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+            type: string
+          kind:
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+            type: string
+          metadata:
+            type: object
+          spec:
+            description: spec holds user settable values for configuration
+            properties:
+              additionalTrustedCA:
+                description: |-
+                  additionalTrustedCA is a reference to a ConfigMap containing additional CAs that
+                  should be trusted during imagestream import, pod image pull, build image pull, and
+                  imageregistry pullthrough.
+                  The namespace for this config map is openshift-config.
+                properties:
+                  name:
+                    description: name is the metadata.name of the referenced config
+                      map
+                    type: string
+                required:
+                - name
+                type: object
+              allowedRegistriesForImport:
+                description: |-
+                  allowedRegistriesForImport limits the container image registries that normal users may import
+                  images from. Set this list to the registries that you trust to contain valid Docker
+                  images and that you want applications to be able to import from. Users with
+                  permission to create Images or ImageStreamMappings via the API are not affected by
+                  this policy - typically only administrators or system integrations will have those
+                  permissions.
+                items:
+                  description: |-
+                    RegistryLocation contains a location of the registry specified by the registry domain
+                    name. The domain name might include wildcards, like '*' or '??'.
+                  properties:
+                    domainName:
+                      description: |-
+                        domainName specifies a domain name for the registry
+                        In case the registry use non-standard (80 or 443) port, the port should be included
+                        in the domain name as well.
+                      type: string
+                    insecure:
+                      description: |-
+                        insecure indicates whether the registry is secure (https) or insecure (http)
+                        By default (if not specified) the registry is assumed as secure.
+                      type: boolean
+                  type: object
+                type: array
+                x-kubernetes-list-type: atomic
+              externalRegistryHostnames:
+                description: |-
+                  externalRegistryHostnames provides the hostnames for the default external image
+                  registry. The external hostname should be set only when the image registry
+                  is exposed externally. The first value is used in 'publicDockerImageRepository'
+                  field in ImageStreams. The value must be in "hostname[:port]" format.
+                items:
+                  type: string
+                type: array
+                x-kubernetes-list-type: atomic
+              registrySources:
+                description: |-
+                  registrySources contains configuration that determines how the container runtime
+                  should treat individual registries when accessing images for builds+pods. (e.g.
+                  whether or not to allow insecure access).  It does not contain configuration for the
+                  internal cluster registry.
+                properties:
+                  allowedRegistries:
+                    description: |-
+                      allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied.
+
+                      Only one of BlockedRegistries or AllowedRegistries may be set.
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  blockedRegistries:
+                    description: |-
+                      blockedRegistries cannot be used for image pull and push actions. All other registries are permitted.
+
+                      Only one of BlockedRegistries or AllowedRegistries may be set.
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                  containerRuntimeSearchRegistries:
+                    description: |-
+                      containerRuntimeSearchRegistries are registries that will be searched when pulling images that do not have fully qualified
+                      domains in their pull specs. Registries will be searched in the order provided in the list.
+                      Note: this search list only works with the container runtime, i.e CRI-O. Will NOT work with builds or imagestream imports.
+                    format: hostname
+                    items:
+                      type: string
+                    minItems: 1
+                    type: array
+                    x-kubernetes-list-type: set
+                  insecureRegistries:
+                    description: insecureRegistries are registries which do not have
+                      a valid TLS certificates or only support HTTP connections.
+                    items:
+                      type: string
+                    type: array
+                    x-kubernetes-list-type: atomic
+                type: object
+                x-kubernetes-validations:
+                - message: Only one of blockedRegistries or allowedRegistries may
+                    be set
+                  rule: 'has(self.blockedRegistries) ? !has(self.allowedRegistries)
+                    : true'
+            type: object
+          status:
+            description: status holds observed values from the cluster. They may not
+              be overridden.
+            properties:
+              externalRegistryHostnames:
+                description: |-
+                  externalRegistryHostnames provides the hostnames for the default external image
+                  registry. The external hostname should be set only when the image registry
+                  is exposed externally. The first value is used in 'publicDockerImageRepository'
+                  field in ImageStreams. The value must be in "hostname[:port]" format.
+                items:
+                  type: string
+                type: array
+                x-kubernetes-list-type: atomic
+              internalRegistryHostname:
+                description: |-
+                  internalRegistryHostname sets the hostname for the default internal image
+                  registry. The value must be in "hostname[:port]" format.
+                  This value is set by the image registry operator which controls the internal registry
+                  hostname.
+                type: string
+            type: object
+        required:
+        - spec
+        type: object
+    served: true
+    storage: true
+    subresources:
+      status: {}