OCPBUGS-105399: Remove SigstoreImageVerification feature gate references

[amritansh1502]

- What I did
Removed all references to the SigstoreImageVerification feature gate from the machine-config-operator. This gate is now enabled by default across all clusterprofiles (Default, OKD, TechPreviewNoUpgrade, DevPreviewNoUpgrade) and is being
removed entirely from openshift/api (see openshift/api#3000), features.FeatureGateSigstoreImageVerification will no longer exist once MCO revendors
- How to verify it

• go build ./pkg/controller/container-runtime-config/... ./pkg/controller/bootstrap/...
• go test ./pkg/controller/container-runtime-config/... ./pkg/controller/bootstrap/...
• grep -rn "SigstoreImageVerification\|sigstoreAPIEnabled" . --exclude-dir=vendor returns no results.
• Presubmit e2e jobs exercise the (now unconditional) image policy path on a live cluster

- Description for the changelog

Remove the SigstoreImageVerification feature gate; sigstore image verification is now always enabled.

Summary by CodeRabbit

• New Features

  • Image policies and cluster image policies are now evaluated consistently whenever policy observers are registered.
  • Image policy processing no longer depends on the Sigstore image verification setting.

• Bug Fixes

  • Improved consistency of image policy handling during bootstrap and container runtime configuration.

• Tests

  • Updated bootstrap and storage configuration coverage to reflect the revised feature-gate behavior.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@amritansh1502: This pull request references Jira Issue OCPBUGS-105399, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

- What I did
Removed all references to the SigstoreImageVerification feature gate from the machine-config-operator. This gate is now enabled by default across all clusterprofiles (Default, OKD, TechPreviewNoUpgrade, DevPreviewNoUpgrade) and is being
removed entirely from openshift/api (see openshift/api#3000), features.FeatureGateSigstoreImageVerification will no longer exist once MCO revendors
- How to verify it

• go build ./pkg/controller/container-runtime-config/... ./pkg/controller/bootstrap/...
• go test ./pkg/controller/container-runtime-config/... ./pkg/controller/bootstrap/...
• grep -rn "SigstoreImageVerification\|sigstoreAPIEnabled" . --exclude-dir=vendor returns no results.
• Presubmit e2e jobs exercise the (now unconditional) image policy path on a live cluster

- Description for the changelog

Remove the SigstoreImageVerification feature gate; sigstore image verification is now always enabled.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6647aa0e-5a06-452d-bef6-3c2d5e83fa9b

📥 Commits

Reviewing files that changed from the base of the PR and between bf208bd and 929d105.

📒 Files selected for processing (1)

• pkg/controller/container-runtime-config/container_runtime_config_controller.go

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

Walkthrough

Image policy observers, policy loading, and bootstrap processing no longer depend on the Sigstore image verification feature gate. The bootstrap API and related test fixtures were updated accordingly.

Changes

Image policy processing

Layer / File(s)	Summary
Unconditional policy observation and processing pkg/controller/container-runtime-config/container_runtime_config_controller.go	The controller registers image policy observers and loads image policies without checking the Sigstore feature gate. The unused helper was removed. RunImageBootstrap always validates image policies.
Bootstrap API and test updates pkg/controller/bootstrap/bootstrap.go, pkg/controller/bootstrap/bootstrap_test.go, pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml, pkg/controller/container-runtime-config/container_runtime_config_controller_test.go	RunImageBootstrap no longer accepts a feature-gate handler. Bootstrap calls and test fixtures no longer enable or disable Sigstore image verification for these cases.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 929d1

This localized change removes obsolete feature-gate references while preserving the intended always-enabled behavior; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: mtrmac, ptalgulk01, qiwang19

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
No-Sensitive-Data-In-Logs	❌ Error	Removing the feature-gate guard activates existing klog output that formats user-supplied ImagePolicy conflict scopes; those scopes can contain internal registry hostnames.	Do not log raw conflictScopes. Log a generic conflict message, or sanitize/redact registry hostnames before logging.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: removing SigstoreImageVerification feature gate references.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes no test titles. Removed feature-gate setup only; existing t.Run names use fixed table values and introduce no dynamic identifiers.
Test Structure And Quality	✅ Passed	Changed tests use standard testing.T, not Ginkgo. The diff only removes feature-gate setup and updates a call; it adds no cluster resources, waits, It blocks, or setup/cleanup risks.
Microshift Test Compatibility	✅ Passed	The patch adds no Ginkgo e2e tests. It only changes existing Go unit-test fixtures and production code, so the MicroShift test-compatibility check does not apply.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only existing Go unit tests and controller code; it adds no Ginkgo e2e tests or multi-node test assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	The HEAD^..HEAD diff only changes Sigstore image-policy handling and tests; no deployments, pod affinity, topology spread, replica, PDB, nodeSelector, or taint scheduling constraints were added.
Ote Binary Stdout Contract	✅ Passed	The commit changes only bootstrap and container-runtime controller code; it does not change the OTE main or suite setup. The added klog call is inside Controller.Run, outside the checked process-le...
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The diff adds no Ginkgo e2e tests. Changed tests use Go testing, and added lines contain no IPv4 literals, IPv6-unsafe URLs, or external connectivity.
No-Weak-Crypto	✅ Passed	The PR diff only removes Sigstore feature-gate plumbing and enables existing policy processing; added-line scans show no MD5, SHA1, DES, RC4, Blowfish, ECB, or custom crypto code.
Container-Privileges	✅ Passed	The PR changes only Go logic/tests and a FeatureGate fixture; no added lines contain privileged:true, host PID/network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation settings.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[Chandan9112]

/retest

[amritansh1502]

/test bootstrap-unit

[JoelSpeed]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-upgrade
/test e2e-gcp-op-ocl-part1
/test e2e-gcp-op-ocl-part2
/test e2e-gcp-op-part1
/test e2e-gcp-op-part2
/test e2e-gcp-op-single-node
/test e2e-hypershift
/test tls-pqc-readiness

[amritansh1502]

/retest

[amritansh1502]

/test e2e-gcp-op-part1
/test e2e-gcp-op-ocl-part1
/test perfscale-control-plane-6nodes

[isabella-janssen]

/approve

Required tests passed and this was approved by Joel (#6445 (comment)) so this should be good to go.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: amritansh1502, isabella-janssen, JoelSpeed

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [isabella-janssen]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[amritansh1502]

/verified by @amritansh1502

[openshift-ci-robot]

@amritansh1502: This PR has been marked as verified by @amritansh1502.

Details

In response to this:

/verified by @amritansh1502

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@amritansh1502: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/perfscale-control-plane-6nodes	929d105	link	false	/test perfscale-control-plane-6nodes

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@amritansh1502: Jira Issue OCPBUGS-105399: Some pull requests linked via external trackers have merged:

• openshift/origin#31521

The following pull request, linked via external tracker, has not merged:

• openshift/api#3000 is open

All associated pull requests must be merged or unlinked from the Jira bug in order for it to move to the next state. Once unlinked, request a bug refresh with /jira refresh.

Jira Issue OCPBUGS-105399 has not been moved to the MODIFIED state.

This PR is marked as verified. If the remaining PRs listed above are marked as verified before merging, the issue will automatically be moved to VERIFIED after all of the changes from the PRs are available in an accepted nightly payload.

Details

In response to this:

- What I did
Removed all references to the SigstoreImageVerification feature gate from the machine-config-operator. This gate is now enabled by default across all clusterprofiles (Default, OKD, TechPreviewNoUpgrade, DevPreviewNoUpgrade) and is being
removed entirely from openshift/api (see openshift/api#3000), features.FeatureGateSigstoreImageVerification will no longer exist once MCO revendors
- How to verify it

• go build ./pkg/controller/container-runtime-config/... ./pkg/controller/bootstrap/...
• go test ./pkg/controller/container-runtime-config/... ./pkg/controller/bootstrap/...
• grep -rn "SigstoreImageVerification\|sigstoreAPIEnabled" . --exclude-dir=vendor returns no results.
• Presubmit e2e jobs exercise the (now unconditional) image policy path on a live cluster

- Description for the changelog

Remove the SigstoreImageVerification feature gate; sigstore image verification is now always enabled.

Summary by CodeRabbit

• New Features

• Image policies and cluster image policies are now evaluated consistently whenever policy observers are registered.

• Image policy processing no longer depends on the Sigstore image verification setting.

• Bug Fixes

• Improved consistency of image policy handling during bootstrap and container runtime configuration.

• Tests

• Updated bootstrap and storage configuration coverage to reflect the revised feature-gate behavior.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.