CNTRLPLANE-631: Add --image-registry-ca-file flag to render command

[devin-ai-integration]

CNTRLPLANE-631: Install image registry CA via MCO in HyperShift

Summary

Adds support for distributing the image registry CA to HyperShift worker nodes via the MCO bootstrap ignition payload, replacing the dependency on the node-ca daemonset. Changes span three repositories:

cluster-version-operator: Adds --image-registry-ca-file flag to the CVO render command. When provided, the CA file is copied into the bootstrap output directory so the MCO bootstrap server can consume it via its --bootstrap-certs flag (added in MCO PR #3876).

enhancements: Updates the certificate-authorities-for-image-registries.md enhancement with a HyperShift-specific workflow section, concrete user stories, test plan, and upgrade/downgrade strategy.

origin: Adds NodeCADaemonRemoved to the image-registry operator exception handlers in monitoring tests, so transient degraded/progressing conditions during node-ca removal don't cause test failures.

Review & Testing Checklist for Human

• Verify NodeCADaemonRemoved is the correct reason string — The origin changes add this as a known exception reason, but this string must match what the image-registry operator will actually emit when the node-ca daemonset is removed. Confirm this with the image-registry team or check the corresponding image-registry-operator PR.
• Verify copyImageRegistryCA destination filename convention — The function uses filepath.Base(caFile) for the output filename. The HyperShift CPO must pass a matching filename to MCO's --bootstrap-certs flag (e.g., image-registry.openshift-image-registry.svc:5000=image-registry-ca.crt). This coupling is implicit — confirm the CPO side will use the expected filename.
• No unit test for copyImageRegistryCA — The new CVO function is a straightforward file copy but has no dedicated test. Consider whether this needs coverage or if integration testing via the CPO is sufficient.
• End-to-end integration — These changes are only part of the full solution. The actual integration requires the HyperShift control-plane-operator to invoke CVO render with --image-registry-ca-file and configure MCO bootstrap with --bootstrap-certs. Verify that the corresponding CPO PR exists and aligns with these changes.

Test Plan

Since this is HyperShift-specific, the full flow requires a HyperShift cluster:

1. Create a HyperShift hosted cluster using the updated CPO (which invokes CVO render with --image-registry-ca-file)
2. Verify the CA appears in the MCO-generated ignition payload at /etc/docker/certs.d/image-registry.openshift-image-registry.svc:5000/ca.crt on worker nodes
3. Verify pulling from the internal registry works on all worker nodes
4. Verify the node-ca daemonset is not running

Notes

• Link to Devin Session: https://redhat.devinenterprise.com/sessions/53fe46443c224d87b66235e740659631
• Requested by: brcox
• All lint checks and tests pass locally
• Related MCO PR: OCPBUGS-17811: add certificate input to bootstrap mcs openshift/machine-config-operator#3876 (merged)
• Related Jira: https://issues.redhat.com/browse/CNTRLPLANE-631

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[bryan-cox]

/close