control-plane-operator/controllers/hostedcontrolplane/v2/cvo: Consume include.release.openshift.io/hypershift-bootstrap annotation

The cluster-version operator has a complicated system for deciding
whether a given release-image manifest should be managed in the
current cluster [1,2].  Implementing that system here, or even using
library-go and remembering to vendor-bump here, both seem like an
annoying maintenance load.

We could use the CVO's render command like the standalone installer
[3,4], but that logic is fairly complicated because it needs to
generate all the artifacts necessary for bootstrap MachineConfig
rendering, or the production machine-config operator will complain
about MachineConfigPools requesting rendered-... MachineConfig that
don't exist.

All we actually need out of the bootstrap container are the resources
that the cluster-version operator needs to launch and run, which are
labeled with the grep target since [5].  That avoids installing
anything the cluster doesn't actually need here by mistake.  Once the
production CVO container starts, it will apply the remaining resources
that the cluster actually needs.

I'm also dropping the openshift-config and openshift-config-managed
Namespace creation.  They are from a30db71 (Refactor
cluster-version-operator, 2024-11-18, openshift#5125), but that commit doesn't
explain why they were added or hint at where they lived before (if
anywhere).  I would expect the cluster-version operator to be able to
create those Namespaces from the release-image manifests when they are
needed, as with other cluster resources.

[1]: https://github.com/openshift/enhancements/blob/2b38513b8661632f08e64f4acc3b856e842f8669/dev-guide/cluster-version-operator/dev/operators.md#manifest-inclusion-annotations
[2]: https://github.com/openshift/library-go/blob/ac826d10cb4081fe3034b027863c08953d95f602/pkg/manifest/manifest.go#L296-L376
[3]: https://github.com/openshift/installer/blob/a300d8c0e9d9d566a85740244a7da74d3d63e23c/data/data/bootstrap/files/usr/local/bin/bootkube.sh.template#L189-L216
[4]: https://github.com/openshift/cluster-version-operator/blob/eaf28f5165bde27435b0f0c9a69458677034a58d/pkg/payload/render.go
[5]: openshift/cluster-version-operator#1352

Author: wking

control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-version-operator/deployment.yaml

@@ -91,13 +91,9 @@ spec:
           cat > /tmp/clusterversion.json <<EOF
           ${CLUSTER_VERSION_JSON}
           EOF
-          oc get ns openshift-config &> /dev/null || oc create ns openshift-config
-          oc get ns openshift-config-managed &> /dev/null || oc create ns openshift-config-managed
-          oc apply -f /var/payload/manifests/0000_00_cluster-version-operator_01_clusterversions*
-          oc apply -f /tmp/clusterversion.json
-          while true; do
+          while test -z "$(oc get -o jsonpath='{.status.history[0].version}' clusterversions.config.openshift.io version)"; do
             echo "Applying CVO bootstrap manifests..."
-            if oc apply -f /var/payload/manifests; then
+            if oc create -f $(grep -rl include.release.openshift.io/hypershift-bootstrap /var/payload/manifests); then
               echo "Bootstrap manifests applied successfully."
               break
             fi

control-plane-operator/controllers/hostedcontrolplane/v2/cvo/deployment.go

@@ -199,47 +199,6 @@ func preparePayloadScript(platformType hyperv1.PlatformType, oauthEnabled bool,
 		fmt.Sprintf("cp -R /release-manifests %s/", payloadDir),
 	)
 
-	// NOTE: We would need part of the manifest.Include logic (https://github.com/openshift/library-go/blob/0064ad7bd060b9fd52f7840972c1d3e72186d0f0/pkg/manifest/manifest.go#L190-L196)
-	// to properly evaluate which CVO manifests to select based on featureset. In the absence of that logic, use simple filename filtering, which is not ideal
-	// but better than nothing.  Ideally, we filter based on the feature-set annotation in the manifests.
-	switch featureSet {
-	case configv1.Default, "":
-		stmts = append(stmts,
-			fmt.Sprintf("rm -f %s/manifests/*-CustomNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-DevPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-TechPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-OKD*.yaml", payloadDir),
-		)
-	case configv1.CustomNoUpgrade:
-		stmts = append(stmts,
-			fmt.Sprintf("rm -f %s/manifests/*-Default*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-DevPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-TechPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-OKD*.yaml", payloadDir),
-		)
-	case configv1.DevPreviewNoUpgrade:
-		stmts = append(stmts,
-			fmt.Sprintf("rm -f %s/manifests/*-Default*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-CustomNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-TechPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-OKD*.yaml", payloadDir),
-		)
-	case configv1.TechPreviewNoUpgrade:
-		stmts = append(stmts,
-			fmt.Sprintf("rm -f %s/manifests/*-Default*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-CustomNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-DevPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-OKD*.yaml", payloadDir),
-		)
-	case configv1.OKD:
-		stmts = append(stmts,
-			fmt.Sprintf("rm -f %s/manifests/*-Default*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-CustomNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-DevPreviewNoUpgrade*.yaml", payloadDir),
-			fmt.Sprintf("rm -f %s/manifests/*-TechPreviewNoUpgrade*.yaml", payloadDir),
-		)
-	}
-
 	for _, manifest := range manifestsToOmit {
 		if platformType == hyperv1.IBMCloudPlatform || platformType == hyperv1.PowerVSPlatform {
 			if manifest == "0000_50_cluster-storage-operator_10_deployment-ibm-cloud-managed.yaml" || manifest == "0000_50_cluster-csi-snapshot-controller-operator_07_deployment-ibm-cloud-managed.yaml" {