WIP 4.16 add Bound service account token type

[sanchezl]

Introduce a configuration option to allow users to specify the type of service account token to use for the integrated image registry image pull secret auth.

apiVersion: operator.openshift.io/v1
kind: OpenShiftControllerManager
spec:
  imageRegistryAuthTokenType: Legacy

In version v4.15:

• The default, and only value, will be Legacy.
• The value will explicitly be added to the OCM-O config.

In version 4.16:

• The default value will be Bound.
• The value will not be explicitly set.
• Users who upgrade from v4.15 will still be configured to use the Legacy service account tokens until they update the OCM-O config to switch to Bound.

[sanchezl]

/hold for #1758 to make it into 4.15

[openshift-ci]

Hello @sanchezl! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: sanchezl
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[JoelSpeed]

Have you tried spinning up a cluster, upgrading it to this CRD, reading it, then removing the default from the CRD spec, and confirming that the resource has got the default as applied? If this is the mechanism for making sure that old clusters upgrade and retain the value, I'm not sure this is going to be effective, you may need a controller to set the value in 4.15

[sanchezl]

The idea is to backport #1758 to 4.15. This PR would be the 4.16 follow-up.

[openshift-ci]

@sanchezl: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.