CNTRLPLANE-631: Update enhancement doc for HyperShift image registry CA via MCO

[devin-ai-integration]

CNTRLPLANE-631: Install image registry CA via MCO in HyperShift

Summary

Implements partial support for distributing the image registry CA to HyperShift worker nodes via MCO bootstrap mode, building on the merged MCO PR #3876 which added the --bootstrap-certs flag.

Changes span three repos:

openshift-devin/enhancements

• Updated enhancements/machine-config/certificate-authorities-for-image-registries.md with a new "HyperShift Workflow" section documenting the end-to-end flow (service-ca → CPO → CVO render → MCO bootstrap → ignition → worker node)
• Added user stories, test plan, upgrade/downgrade strategy, and implementation history

openshift-devin/cluster-version-operator

• Added --image-registry-ca-file flag to the render subcommand
• Added copyImageRegistryCA() function that copies the CA file into the bootstrap output directory for MCO consumption
• Updated Render() function signature to thread the new parameter through

openshift-devin/origin

• Added "NodeCADaemonRemoved" to the image-registry operator exception handlers in both the degraded-state and progressing-state transition monitors

Review & Testing Checklist for Human

• Verify "NodeCADaemonRemoved" reason string: This is speculative — confirm this matches the actual reason the image-registry operator will emit when the node-ca daemon set is removed. If the operator uses a different string, the monitoring exceptions won't fire correctly.
• Verify copyImageRegistryCA destination filename contract: The function uses filepath.Base(caFile) for the output filename. The control-plane-operator must reference the same filename when passing --bootstrap-certs to MCO. Confirm this naming convention is agreed upon across components.
• No unit tests for copyImageRegistryCA: The new CVO function has no test coverage. Consider whether a test should be added for the file-copy logic and error handling paths.
• Enhancement doc accuracy: The HyperShift workflow section describes a 6-step flow spanning service-ca, CPO, CVO, and MCO. Verify this matches the intended architecture, especially steps 2-4 which describe CPO behavior that isn't implemented in this PR.
• Test plan: No automated end-to-end tests are possible since this depends on unreleased changes in control-plane-operator and image-registry operator. Manual testing will require deploying a full HyperShift hosted cluster with the CPO changes that invoke cvo render --image-registry-ca-file.

Notes

These changes are part of a larger multi-repo effort tracked in CNTRLPLANE-631. This PR implements:

• Documentation of the intended workflow
• The CVO render machinery to copy the CA file
• Monitoring exceptions for when node-ca is removed

NOT included (tracked separately):

• Control-plane-operator changes to invoke cvo render --image-registry-ca-file
• Image-registry operator changes to remove node-ca daemon set and emit appropriate status reasons
• Actual node-ca daemon set removal (tracked in IR-373 and RFE-8702)

Related PR: MCO #3876 (merged) which added the --bootstrap-certs flag to machine-config-server.

---

Link to Devin Session: https://redhat.devinenterprise.com/sessions/53fe46443c224d87b66235e740659631
Requested by: brcox

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[bryan-cox]

/close