WIP 4.16 add Bound service account token type

openapi/openapi.json

@@ -29375,6 +29375,10 @@
         "managementState"
       ],
       "properties": {
+        "imageRegistryAuthTokenType": {
+          "description": "imageRegistryAuthTokenType directs the openshift-controller-manager to use either a legacy,(unbound, long-lived) service acccount tokens or a bound service account token when generating image pull secrets for the integrated image registry.",
+          "type": "string"
+        },
         "logLevel": {
           "description": "logLevel is an intent based logging for an overall component.  It does not give fine grained control, but it is a simple way to manage coarse grained logging choices that operators have to interpret for their operands.\n\nValid values are: \"Normal\", \"Debug\", \"Trace\", \"TraceAll\". Defaults to \"Normal\".",
           "type": "string"

operator/v1/0000_50_cluster-openshift-controller-manager-operator_02_config.crd.yaml

@@ -39,6 +39,16 @@ spec:
             type: object
           spec:
             properties:
+              imageRegistryAuthTokenType:
+                default: Bound
+                description: imageRegistryAuthTokenType directs the openshift-controller-manager
+                  to use either a legacy,(unbound, long-lived) service acccount tokens
+                  or a bound service account token when generating image pull secrets
+                  for the integrated image registry.
+                enum:
+                - Legacy
+                - Bound
+                type: string
               logLevel:
                 default: Normal
                 description: "logLevel is an intent based logging for an overall component.

operator/v1/stable.openshiftcontrollermanager.testsuite.yaml

@@ -12,5 +12,6 @@ tests:
       apiVersion: operator.openshift.io/v1
       kind: OpenShiftControllerManager
       spec:
+        imageRegistryAuthTokenType: Bound
         logLevel: Normal
         operatorLogLevel: Normal

operator/v1/types_openshiftcontrollermanager.go

@@ -28,8 +28,23 @@ type OpenShiftControllerManager struct {
 
 type OpenShiftControllerManagerSpec struct {
 	OperatorSpec `json:",inline"`
+
+	// imageRegistryAuthTokenType directs the openshift-controller-manager to use either a
+	// legacy,(unbound, long-lived) service acccount tokens or a bound service account
+	// token when generating image pull secrets for the integrated image registry.
+	// +kubebuilder:default=Bound
+	// +kubebuilder:validation:Enum=Legacy;Bound
+	// +optional
+	ImageRegistryAuthTokenType ServiceAccountTokenType `json:"imageRegistryAuthTokenType,omitempty"`
 }
 
+type ServiceAccountTokenType string
+
+const (
+	ServiceAccountLegacyTokenType ServiceAccountTokenType = "Legacy"
+	ServiceAccountBoundTokenType  ServiceAccountTokenType = "Bound"
+)
+
 type OpenShiftControllerManagerStatus struct {
 	OperatorStatus `json:",inline"`
 }