Support Cluster ImagePolicy CRD

Signed-off-by: Qi Wang <qiwan@redhat.com>

cmd/machine-config-controller/start.go

@@ -172,6 +172,7 @@ func createControllers(ctx *ctrlcommon.ControllerContext) []ctrlcommon.Controlle
 			ctx.ConfigInformerFactory.Config().V1().Images(),
 			ctx.ConfigInformerFactory.Config().V1().ImageDigestMirrorSets(),
 			ctx.ConfigInformerFactory.Config().V1().ImageTagMirrorSets(),
+			ctx.ConfigInformerFactory.Config().V1alpha1().ClusterImagePolicies(),
 			ctx.OperatorInformerFactory.Operator().V1alpha1().ImageContentSourcePolicies(),
 			ctx.ConfigInformerFactory.Config().V1().ClusterVersions(),
 			ctx.ClientBuilder.KubeClientOrDie("container-runtime-config-controller"),

docs/ClusterImagePolicyDesign.md

@@ -0,0 +1,95 @@
+## Summary
+ClusterImagePolicy CRD is managed by ContainerRuntimeConfig controller. This CRD allows setting up configurations for CRI-O to verify the container images signed using [Sigstore](https://www.sigstore.dev/) tools.
+
+## Goals
+Generating corresponding CRI-O configuration files for image signature verification. Rollout ClusterImagePolicy to `/etc/containers/policy.json` for cluster wide configuration. Roll out the registries configuration to `/etc/containers/registries.d/sigstore-registries.yaml`.
+
+## Non-Goals
+Rolling out configuration for OCP payload repositories. The (super scope of) OCP payload repositories will not be written to the configuration files. 
+
+## CRD
+[ClusterImagePolicy CRD](https://github.com/openshift/api/blob/master/config/v1alpha1/0000_10_config-operator_01_clusterimagepolicy-TechPreviewNoUpgrade.crd.yaml)
+
+## Example
+
+Below is an example of a ClusterImagePolicy CRD.
+
+```yaml
+apiVersion: config.openshift.io/v1alpha1
+kind: ClusterImagePolicy 
+metadata:
+  name: p0
+spec:
+  scopes:
+    - registry.ci.openshift.org
+    - example.com/global
+  policy:
+    rootOfTrust:
+      policyType: PublicKey
+      publicKey:
+        keyData: Zm9vIGJhcg==
+    signedIdentity:
+      matchPolicy: MatchRepoDigestOrExact
+```
+
+Save the above clusterimagepolicy locally, for example as pubKeyPolicy.yaml.
+Now apply the clusterimagepolicy that you created:
+
+```shell
+oc apply -f pubKeyPolicy.yaml
+```
+
+Check that it was created:
+
+```shell
+oc get clusterimagepolicy
+NAME   AGE
+p0     9s
+
+```
+
+## Validation and Troubleshooting
+The status.conditions.message field shows if the CR has conflicting scope(s). The below ClusterImagePolicy is in pending status because the scope for OCP release payload is skipped.
+
+```shell
+# the clusterimagepolicy has scope registry.build05.ci.openshift.org that is the OCP release payload repository
+$ oc describe clusterimagepolicy.config.openshift.io/p0
+...
+...
+Status:
+  Conditions:
+    Last Transition Time:  2024-02-04T03:24:36Z
+    Message:               has conflict scope(s) ["registry.build05.ci.openshift.org"] of Openshift payload repository registry.build05.ci.openshift.org/ci-ln-gfmf0yb/release, skip the scope(s)
+    Observed Generation:   1
+    Reason:                ConflictScopes
+    Status:                True
+    Type:                  Pending
+```
+
+The machine-config-controller logs will show the error message if the ClusterImagePolicy and Image CR has conflicting configurations. Controller will fail to roll out the CR. For example, the below error message is shown when the ClusterImagePolicy and blockedRegistries of Image CR has conflicting configurations.
+
+```shell
+I0204 03:51:18.253145       1 container_runtime_config_controller.go:497] Error syncing image config openshift-config: could not Create/Update MachineConfig: could not update policy json with new changes: blockedRegistries and clusterimagePolicy configured for the same scope example.com/global ```
+```
+
+## Implementation Details
+The ContainerRuntimeConfigController would perform the following steps:
+
+1. Validate the ClusterImagePolicy objects are not for OCP release payload repositories.
+
+2. Render the current MachineConfigs (storage.files.contents[policy.json]) into the originalPolicyIgn
+
+3. Serialize the cluster level policies to `policy.json`.
+
+4. Add registries configuration to `sigstore-registries.yaml`. This configuration is used to specify the sigstore is being used as the image signature verification backend. 
+
+5. Update the ignition file `/etc/containers/policy.json` within the `99-<pool>-generated-registries` MachineConfig.
+
+6. Create or Update the ignition file `/etc/containers/registries.d/sigstore-registries.yaml` within the `99-<pool>-generated-imagepolicies` MachineConfig. 
+
+After deletion all of the ClusterImagePolicy instance the config will be reverted to the original policy.json.
+
+## See Also
+see **[containers-policy.json(5)](https://github.com/containers/image/blob/main/docs/containers-policy.json.5.md)**, **[containers-registries.d(5)](https://github.com/containers/image/blob/main/docs/containers-registries.d.5.md)**  for more information.
+
+

manifests/machineconfigcontroller/clusterrole.yaml

@@ -13,10 +13,10 @@ rules:
   resources: ["configmaps", "secrets"]
   verbs: ["*"]
 - apiGroups: ["config.openshift.io"]
-  resources: ["images", "clusterversions", "featuregates", "nodes", "nodes/status"]
+  resources: ["images", "clusterversions", "featuregates", "nodes", "nodes/status", "clusterimagepolicies/status"]
   verbs: ["*"]
 - apiGroups: ["config.openshift.io"]
-  resources: ["schedulers", "apiservers", "infrastructures", "imagedigestmirrorsets", "imagetagmirrorsets"]
+  resources: ["schedulers", "apiservers", "infrastructures", "imagedigestmirrorsets", "imagetagmirrorsets", "clusterimagepolicies"]
   verbs: ["get", "list", "watch"]
 - apiGroups: ["operator.openshift.io"]
   resources: ["imagecontentsourcepolicies"]

pkg/apihelpers/apihelpers.go

@@ -99,6 +99,16 @@ func NewKubeletConfigCondition(condType mcfgv1.KubeletConfigStatusConditionType,
 	}
 }
 
+func NewCondition(condType string, status metav1.ConditionStatus, reason, message string) *metav1.Condition {
+	return &metav1.Condition{
+		Type:               condType,
+		Status:             status,
+		LastTransitionTime: metav1.Now(),
+		Reason:             reason,
+		Message:            message,
+	}
+}
+
 // NewContainerRuntimeConfigCondition returns an instance of a ContainerRuntimeConfigCondition
 func NewContainerRuntimeConfigCondition(condType mcfgv1.ContainerRuntimeConfigStatusConditionType, status corev1.ConditionStatus, message string) *mcfgv1.ContainerRuntimeConfigCondition {
 	return &mcfgv1.ContainerRuntimeConfigCondition{

pkg/controller/bootstrap/bootstrap.go

@@ -19,6 +19,7 @@ import (
 	"k8s.io/klog/v2"
 
 	apicfgv1 "github.com/openshift/api/config/v1"
+	apicfgv1alpha1 "github.com/openshift/api/config/v1alpha1"
 	mcfgv1 "github.com/openshift/api/machineconfiguration/v1"
 	apioperatorsv1alpha1 "github.com/openshift/api/operator/v1alpha1"
 	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
@@ -72,20 +73,24 @@ func (b *Bootstrap) Run(destDir string) error {
 	mcfgv1.Install(scheme)
 	apioperatorsv1alpha1.Install(scheme)
 	apicfgv1.Install(scheme)
+	apicfgv1alpha1.Install(scheme)
 	codecFactory := serializer.NewCodecFactory(scheme)
-	decoder := codecFactory.UniversalDecoder(mcfgv1.GroupVersion, apioperatorsv1alpha1.GroupVersion, apicfgv1.GroupVersion)
-
-	var cconfig *mcfgv1.ControllerConfig
-	var featureGate *apicfgv1.FeatureGate
-	var nodeConfig *apicfgv1.Node
-	var kconfigs []*mcfgv1.KubeletConfig
-	var pools []*mcfgv1.MachineConfigPool
-	var configs []*mcfgv1.MachineConfig
-	var crconfigs []*mcfgv1.ContainerRuntimeConfig
-	var icspRules []*apioperatorsv1alpha1.ImageContentSourcePolicy
-	var idmsRules []*apicfgv1.ImageDigestMirrorSet
-	var itmsRules []*apicfgv1.ImageTagMirrorSet
-	var imgCfg *apicfgv1.Image
+	decoder := codecFactory.UniversalDecoder(mcfgv1.GroupVersion, apioperatorsv1alpha1.GroupVersion, apicfgv1.GroupVersion, apicfgv1alpha1.GroupVersion)
+
+	var (
+		cconfig              *mcfgv1.ControllerConfig
+		featureGate          *apicfgv1.FeatureGate
+		nodeConfig           *apicfgv1.Node
+		kconfigs             []*mcfgv1.KubeletConfig
+		pools                []*mcfgv1.MachineConfigPool
+		configs              []*mcfgv1.MachineConfig
+		crconfigs            []*mcfgv1.ContainerRuntimeConfig
+		icspRules            []*apioperatorsv1alpha1.ImageContentSourcePolicy
+		idmsRules            []*apicfgv1.ImageDigestMirrorSet
+		itmsRules            []*apicfgv1.ImageTagMirrorSet
+		clusterImagePolicies []*apicfgv1alpha1.ClusterImagePolicy
+		imgCfg               *apicfgv1.Image
+	)
 	for _, info := range infos {
 		if info.IsDir() {
 			continue
@@ -132,6 +137,8 @@ func (b *Bootstrap) Run(destDir string) error {
 				itmsRules = append(itmsRules, obj)
 			case *apicfgv1.Image:
 				imgCfg = obj
+			case *apicfgv1alpha1.ClusterImagePolicy:
+				clusterImagePolicies = append(clusterImagePolicies, obj)
 			case *apicfgv1.FeatureGate:
 				if obj.GetName() == ctrlcommon.ClusterFeatureInstanceName {
 					featureGate = obj
@@ -168,7 +175,7 @@ func (b *Bootstrap) Run(destDir string) error {
 
 	configs = append(configs, iconfigs...)
 
-	rconfigs, err := containerruntimeconfig.RunImageBootstrap(b.templatesDir, cconfig, pools, icspRules, idmsRules, itmsRules, imgCfg, fgAccess)
+	rconfigs, err := containerruntimeconfig.RunImageBootstrap(b.templatesDir, cconfig, pools, icspRules, idmsRules, itmsRules, imgCfg, clusterImagePolicies, fgAccess)
 	if err != nil {
 		return err
 	}

pkg/controller/bootstrap/testdata/bootstrap/featuregate.yaml

@@ -7,3 +7,5 @@ status:
   - version: 0.0.1-snapshot
     enabled:
     - name: OpenShiftPodSecurityAdmission
+    disabled:
+    - name: SigstoreImageVerification