remove RouteExternalCertificate feature gate

jcmoraisjr · jcmoraisjr · commit 60431812d502 · 2026-02-24T10:51:07.000-03:00
RouteExternalCertificate is enabled by default, this update is removing
its declaration from the legacy featuregates list, from CRD
declarations and from type annotations.
diff --git a/features.md b/features.md
@@ -102,7 +102,6 @@
 | MutableCSINodeAllocatableCount| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | OpenShiftPodSecurityAdmission| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | PinnedImages| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
-| RouteExternalCertificate| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | ServiceAccountTokenNodeBinding| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | SigstoreImageVerification| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | SigstoreImageVerificationPKI| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
diff --git a/features/features.go b/features/features.go
@@ -192,14 +192,6 @@ var (
 					enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
 					mustRegister()
 
-	FeatureGateRouteExternalCertificate = newFeatureGate("RouteExternalCertificate").
-						reportProblemsToJiraComponent("router").
-						contactPerson("chiragkyal").
-						productScope(ocpSpecific).
-						enhancementPR(legacyFeatureGateWithoutEnhancement).
-						enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
-						mustRegister()
-
 	FeatureGateNetworkConnect = newFeatureGate("NetworkConnect").
 					reportProblemsToJiraComponent("Networking/ovn-kubernetes").
 					contactPerson("tssurya").
diff --git a/features/legacyfeaturegates.go b/features/legacyfeaturegates.go
@@ -85,8 +85,6 @@ var legacyFeatureGates = sets.New(
 	// never add to this list, if you think you have an exception ask @deads2k
 	"PrivateHostedZoneAWS",
 	// never add to this list, if you think you have an exception ask @deads2k
-	"RouteExternalCertificate",
-	// never add to this list, if you think you have an exception ask @deads2k
 	"SetEIPForNLBIngressController",
 	// never add to this list, if you think you have an exception ask @deads2k
 	"SignatureStores",
diff --git a/payload-command/render/legacyfeaturegates.go b/payload-command/render/legacyfeaturegates.go
@@ -89,8 +89,6 @@ var legacyFeatureGates = sets.New(
 	// never add to this list, if you think you have an exception ask @deads2k
 	"PrivateHostedZoneAWS",
 	// never add to this list, if you think you have an exception ask @deads2k
-	"RouteExternalCertificate",
-	// never add to this list, if you think you have an exception ask @deads2k
 	"SetEIPForNLBIngressController",
 	// never add to this list, if you think you have an exception ask @deads2k
 	"SignatureStores",
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
@@ -322,9 +322,6 @@
                     {
                         "name": "PinnedImages"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "ServiceAccountTokenNodeBinding"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
@@ -306,9 +306,6 @@
                     {
                         "name": "ProvisioningRequestAvailable"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "SELinuxMount"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
@@ -324,9 +324,6 @@
                     {
                         "name": "PinnedImages"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "ServiceAccountTokenNodeBinding"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
@@ -306,9 +306,6 @@
                     {
                         "name": "PinnedImages"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "SELinuxMount"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
@@ -322,9 +322,6 @@
                     {
                         "name": "PinnedImages"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "ServiceAccountTokenNodeBinding"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
@@ -306,9 +306,6 @@
                     {
                         "name": "ProvisioningRequestAvailable"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "SELinuxMount"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
@@ -324,9 +324,6 @@
                     {
                         "name": "PinnedImages"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "ServiceAccountTokenNodeBinding"
                     },
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
@@ -306,9 +306,6 @@
                     {
                         "name": "PinnedImages"
                     },
-                    {
-                        "name": "RouteExternalCertificate"
-                    },
                     {
                         "name": "SELinuxMount"
                     },
diff --git a/route/v1/generated.proto b/route/v1/generated.proto
diff --git a/route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml b/route/v1/tests/routes.route.openshift.io/RouteExternalCertificate.yaml
@@ -1,8 +1,6 @@
 apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
 name: "Route"
 crdName: routes.route.openshift.io
-featureGates:
-- RouteExternalCertificate
 tests:
   onCreate:
     - name: Should be able to create a minimal Route
diff --git a/route/v1/types.go b/route/v1/types.go
@@ -422,7 +422,7 @@ type RouterShard struct {
 // TLSConfig defines config used to secure a route and provide termination
 //
 // +kubebuilder:validation:XValidation:rule="has(self.termination) && has(self.insecureEdgeTerminationPolicy) ? !((self.termination=='passthrough') && (self.insecureEdgeTerminationPolicy=='Allow')) : true", message="cannot have both spec.tls.termination: passthrough and spec.tls.insecureEdgeTerminationPolicy: Allow"
-// +openshift:validation:FeatureGateAwareXValidation:featureGate=RouteExternalCertificate,rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
+// +kubebuilder:validation:XValidation:rule="!(has(self.certificate) && has(self.externalCertificate))", message="cannot have both spec.tls.certificate and spec.tls.externalCertificate"
 type TLSConfig struct {
 	// termination indicates the TLS termination type.
 	//
@@ -475,7 +475,6 @@ type TLSConfig struct {
 	// The router service account needs to be granted with read-only access to this secret,
 	// please refer to openshift docs for additional details.
 	//
-	// +openshift:enable:FeatureGate=RouteExternalCertificate
 	// +optional
 	ExternalCertificate *LocalObjectReference `json:"externalCertificate,omitempty" protobuf:"bytes,7,opt,name=externalCertificate"`
 }
diff --git a/route/v1/zz_generated.crd-manifests/routes.crd.yaml b/route/v1/zz_generated.crd-manifests/routes.crd.yaml
@@ -558,13 +558,13 @@ spec:
                 - termination
                 type: object
                 x-kubernetes-validations:
-                - message: cannot have both spec.tls.certificate and spec.tls.externalCertificate
-                  rule: '!(has(self.certificate) && has(self.externalCertificate))'
                 - message: 'cannot have both spec.tls.termination: passthrough and
                     spec.tls.insecureEdgeTerminationPolicy: Allow'
                   rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy)
                     ? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow''))
                     : true'
+                - message: cannot have both spec.tls.certificate and spec.tls.externalCertificate
+                  rule: '!(has(self.certificate) && has(self.externalCertificate))'
               to:
                 description: |-
                   to is an object the route should use as the primary backend. Only the Service kind
diff --git a/route/v1/zz_generated.featuregated-crd-manifests.yaml b/route/v1/zz_generated.featuregated-crd-manifests.yaml
@@ -4,8 +4,7 @@ routes.route.openshift.io:
   CRDName: routes.route.openshift.io
   Capability: ""
   Category: ""
-  FeatureGates:
-  - RouteExternalCertificate
+  FeatureGates: []
   FilenameOperatorName: ""
   FilenameOperatorOrdering: ""
   FilenameRunLevel: ""
diff --git a/route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/AAA_ungated.yaml b/route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/AAA_ungated.yaml
@@ -443,6 +443,23 @@ spec:
                       the short service name (service.namespace.svc), which allows infrastructure generated certificates to automatically
                       verify.
                     type: string
+                  externalCertificate:
+                    description: |-
+                      externalCertificate provides certificate contents as a secret reference.
+                      This should be a single serving certificate, not a certificate
+                      chain. Do not include a CA certificate. The secret referenced should
+                      be present in the same namespace as that of the Route.
+                      Forbidden when `certificate` is set.
+                      The router service account needs to be granted with read-only access to this secret,
+                      please refer to openshift docs for additional details.
+                    properties:
+                      name:
+                        description: |-
+                          name of the referent.
+                          More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                        type: string
+                    type: object
+                    x-kubernetes-map-type: atomic
                   insecureEdgeTerminationPolicy:
                     description: |-
                       insecureEdgeTerminationPolicy indicates the desired behavior for insecure connections to a route. While
@@ -489,6 +506,8 @@ spec:
                   rule: 'has(self.termination) && has(self.insecureEdgeTerminationPolicy)
                     ? !((self.termination==''passthrough'') && (self.insecureEdgeTerminationPolicy==''Allow''))
                     : true'
+                - message: cannot have both spec.tls.certificate and spec.tls.externalCertificate
+                  rule: '!(has(self.certificate) && has(self.externalCertificate))'
               to:
                 description: |-
                   to is an object the route should use as the primary backend. Only the Service kind
diff --git a/route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/RouteExternalCertificate.yaml b/route/v1/zz_generated.featuregated-crd-manifests/routes.route.openshift.io/RouteExternalCertificate.yaml

Original file line number	Diff line number	Diff line change
`@@ -322,9 +322,6 @@`
`322`	`322`	`{`
`323`	`323`	`"name": "PinnedImages"`
`324`	`324`	`},`
`325`		`- {`
`326`		`- "name": "RouteExternalCertificate"`
`327`		`- },`
`328`	`325`	`{`
`329`	`326`	`"name": "ServiceAccountTokenNodeBinding"`
`330`	`327`	`},`
Original file line number	Diff line number	Diff line change
`@@ -306,9 +306,6 @@`
`306`	`306`	`{`
`307`	`307`	`"name": "ProvisioningRequestAvailable"`
`308`	`308`	`},`
`309`		`- {`
`310`		`- "name": "RouteExternalCertificate"`
`311`		`- },`
`312`	`309`	`{`
`313`	`310`	`"name": "SELinuxMount"`
`314`	`311`	`},`
Original file line number	Diff line number	Diff line change
`@@ -324,9 +324,6 @@`
`324`	`324`	`{`
`325`	`325`	`"name": "PinnedImages"`
`326`	`326`	`},`
`327`		`- {`
`328`		`- "name": "RouteExternalCertificate"`
`329`		`- },`
`330`	`327`	`{`
`331`	`328`	`"name": "ServiceAccountTokenNodeBinding"`
`332`	`329`	`},`