CNTRLPLANE-631: Pass image registry CA via --bootstrap-certs to MCS bootstrap

[devin-ai-integration]

What this PR does / why we need it:

In HyperShift hosted clusters, the MCO runs only in bootstrap mode and the node-ca daemonset does not run on worker nodes. This means there is no mechanism to distribute the image registry CA to nodes so they can pull from the internal registry at image-registry.openshift-image-registry.svc:5000.

This PR adds logic to the ignition server's LocalIgnitionProvider.GetPayload() to pass the image registry CA to the machine-config-server (MCS) bootstrap command via --bootstrap-certs. The MCS then places the CA at /etc/docker/certs.d/<registry>/ca.crt in the ignition payload for worker nodes.

The change:

1. Before running MCS bootstrap, checks if the image registry capability is enabled on the HostedControlPlane
2. If enabled, writes the root CA cert (from the MCS config) to a file
3. Passes --bootstrap-certs=image-registry.openshift-image-registry.svc:5000=<ca-file> to the MCS bootstrap command (gated on payload version >= 4.14, when --bootstrap-certs was introduced in MCO PR #3876)

Which issue(s) this PR fixes:

Fixes https://issues.redhat.com/browse/CNTRLPLANE-631

Special notes for your reviewer:

Key items to verify:

1. Is the root CA the correct CA for the image registry endpoint? This PR uses the root CA (mcsConfig.Data["root-ca.crt"]) based on the observation that pki.ReconcileRegistryOperatorServingCert signs with the root CA. However, ReconcileRegistryOperatorServingCert generates a cert for hostname cluster-image-registry-operator (the operator's metrics endpoint), not for image-registry.openshift-image-registry.svc:5000 (the registry data endpoint). The registry data endpoint's serving cert may be generated by the service-ca operator in the guest cluster instead. Please confirm which CA actually signs the image registry's serving certificate that nodes use when pulling images.

2. Is --bootstrap-certs=hostname=filepath the correct flag format? This is based on the enhancement doc and MCO PR NO-ISSUE: *: use the api package constant for the size label openshift/hypershift#3876 but has not been tested against a live MCS binary.

3. Is the version gate (>= 4.14) correct? MCO PR NO-ISSUE: *: use the api package constant for the size label openshift/hypershift#3876 was merged 2023-09-25. If it landed in 4.15 instead of 4.14, passing --bootstrap-certs to a 4.14 MCS binary would cause a hard failure.

4. Silent failure pattern: Errors during CA setup (HCP list failure, file write failure) are logged but do not fail the payload generation. MCS runs without --bootstrap-certs in those cases.

Related PRs:

• Enhancement doc: CNTRLPLANE-631: Update enhancement doc for HyperShift image registry CA via MCO enhancements#1
• CVO changes: CNTRLPLANE-631: Add --image-registry-ca-file flag to render command cluster-version-operator#1 (added --image-registry-ca-file flag to render command, though this PR does not invoke CVO render)
• Origin monitoring: CNTRLPLANE-631: Handle node-ca daemon removal in monitoring exceptions origin#2

Testing:

• go build ./ignition-server/... passes
• go vet ./ignition-server/... passes
• go test ./ignition-server/... passes
• No e2e test coverage for this change (ignition-server has no existing e2e harness)

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs. (No docs in HyperShift repo for ignition provider internals)
• This change includes unit tests. (No unit tests added; existing tests pass)

---

Devin Session: https://redhat.devinenterprise.com/sessions/53fe46443c224d87b66235e740659631
Requested by: brcox (brcox@redhat.com)

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 4 additional findings.