Bug 1794313: Some cluster operators fail to come up because RHV CA is not trusted by a pod

data/data/manifests/openshift/cloud-creds-secret.yaml.template

@@ -41,4 +41,5 @@ data:
   ovirt_password: {{.CloudCreds.Ovirt.Base64encodePassword}}
   ovirt_cafile: {{.CloudCreds.Ovirt.Base64encodeCAFile}}
   ovirt_insecure: {{.CloudCreds.Ovirt.Base64encodeInsecure}}
+  ovirt_ca_bundle: {{.CloudCreds.Ovirt.Base64encodeCABundle}}
 {{- end}}

pkg/asset/installconfig/ovirt/config.go

@@ -18,6 +18,7 @@ type Config struct {
 	Password string `yaml:"ovirt_password"`
 	CAFile   string `yaml:"ovirt_cafile,omitempty"`
 	Insecure bool   `yaml:"ovirt_insecure,omitempty"`
+	CABundle string `yaml:"ovirt_ca_bundle,omitempty"`
 }
 
 // LoadOvirtConfig from the following location (first wins):

pkg/asset/installconfig/ovirt/credentials.go

@@ -1,6 +1,9 @@
 package ovirt
 
 import (
+	"fmt"
+	"net/url"
+
 	"gopkg.in/AlecAivazis/survey.v1"
 )
 
@@ -23,7 +26,7 @@ func askCredentials() (Config, error) {
 	err = survey.AskOne(
 		&survey.Confirm{
 			Message: "Is the installed oVirt certificate trusted?",
-			Default: false,
+			Default: true,
 			Help:    "",
 		},
 		&ovirtCertTrusted,
@@ -33,6 +36,28 @@ func askCredentials() (Config, error) {
 	}
 	c.Insecure = !ovirtCertTrusted
 
+	if ovirtCertTrusted {
+		ovirtURL, err := url.Parse(c.URL)
+		if err != nil {
+			// should have passed validation, this is unexpected
+			return c, err
+		}
+		pemURL := fmt.Sprintf(
+			"%s://%s/ovirt-engine/services/pki-resource?resource=ca-certificate&format=X509-PEM-CA",
+			ovirtURL.Scheme,
+			ovirtURL.Host)
+
+		err = survey.AskOne(&survey.Multiline{
+			Message: "Enter oVirt's CA bundle",
+			Help:    "Obtain oVirt CA bundle from " + pemURL,
+		},
+			&c.CABundle,
+			survey.ComposeValidators(survey.Required))
+		if err != nil {
+			return c, err
+		}
+	}
+
 	err = survey.Ask([]*survey.Question{
 		{
 			Prompt: &survey.Input{

pkg/asset/manifests/openshift.go

@@ -175,6 +175,7 @@ func (o *Openshift) Generate(dependencies asset.Parents) error {
 				Base64encodePassword: base64.StdEncoding.EncodeToString([]byte(conf.Password)),
 				Base64encodeCAFile:   base64.StdEncoding.EncodeToString([]byte(conf.CAFile)),
 				Base64encodeInsecure: base64.StdEncoding.EncodeToString([]byte(strconv.FormatBool(conf.Insecure))),
+				Base64encodeCABundle: base64.StdEncoding.EncodeToString([]byte(conf.CABundle)),
 			},
 		}
 	}

pkg/asset/manifests/template.go

@@ -44,6 +44,7 @@ type OvirtCredsSecretData struct {
 	Base64encodePassword string
 	Base64encodeCAFile   string
 	Base64encodeInsecure string
+	Base64encodeCABundle string
 }
 
 type cloudCredsSecretData struct {