openshift · amritansh1502 · Aug 21, 2026
diff --git a/...enshift.io/SigstoreImageVerification.yaml → ...cies.config.openshift.io/AAA_ungated.yaml b/...enshift.io/SigstoreImageVerification.yaml → ...cies.config.openshift.io/AAA_ungated.yaml
diff --git a/config/v1/tests/clusterimagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml b/config/v1/tests/clusterimagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml
diff --git a/...enshift.io/SigstoreImageVerification.yaml → ...cies.config.openshift.io/AAA_ungated.yaml b/...enshift.io/SigstoreImageVerification.yaml → ...cies.config.openshift.io/AAA_ungated.yaml
diff --git a/config/v1/tests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml b/config/v1/tests/imagepolicies.config.openshift.io/SigstoreImageVerificationPKI.yaml
diff --git a/config/v1/types_cluster_image_policy.go b/config/v1/types_cluster_image_policy.go
@@ -14,7 +14,6 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 // +kubebuilder:subresource:status
 // +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2310
 // +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01
-// +openshift:enable:FeatureGate=SigstoreImageVerification
 // +openshift:compatibility-gen:level=1
 type ClusterImagePolicy struct {
 	metav1.TypeMeta `json:",inline"`

diff --git a/config/v1/types_image_policy.go b/config/v1/types_image_policy.go
@@ -13,7 +13,6 @@ import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 // +kubebuilder:subresource:status
 // +openshift:api-approved.openshift.io=https://github.com/openshift/api/pull/2310
 // +openshift:file-pattern=cvoRunLevel=0000_10,operatorName=config-operator,operatorOrdering=01
-// +openshift:enable:FeatureGate=SigstoreImageVerification
 // +openshift:compatibility-gen:level=1
 type ImagePolicy struct {
 	metav1.TypeMeta `json:",inline"`
@@ -76,7 +75,7 @@ type ImageSigstoreVerificationPolicy struct {
 // +union
 // +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'PublicKey' ? has(self.publicKey) : !has(self.publicKey)",message="publicKey is required when policyType is PublicKey, and forbidden otherwise"
 // +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'FulcioCAWithRekor' ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)",message="fulcioCAWithRekor is required when policyType is FulcioCAWithRekor, and forbidden otherwise"
-// +openshift:validation:FeatureGateAwareXValidation:featureGate=SigstoreImageVerificationPKI,rule="has(self.policyType) && self.policyType == 'PKI' ? has(self.pki) : !has(self.pki)",message="pki is required when policyType is PKI, and forbidden otherwise"
+// +kubebuilder:validation:XValidation:rule="has(self.policyType) && self.policyType == 'PKI' ? has(self.pki) : !has(self.pki)",message="pki is required when policyType is PKI, and forbidden otherwise"
 type PolicyRootOfTrust struct {
 	// policyType is a required field specifies the type of the policy for verification. This field must correspond to how the policy was generated.
 	// Allowed values are "PublicKey", "FulcioCAWithRekor", and "PKI".
@@ -99,12 +98,10 @@ type PolicyRootOfTrust struct {
 	// pki defines the root of trust configuration based on Bring Your Own Public Key Infrastructure (BYOPKI) Root CA(s) and corresponding intermediate certificates.
 	// pki is required when policyType is PKI, and forbidden otherwise.
 	// +optional
-	// +openshift:enable:FeatureGate=SigstoreImageVerificationPKI
 	PKI *ImagePolicyPKIRootOfTrust `json:"pki,omitempty"`
 }
 
-// +openshift:validation:FeatureGateAwareEnum:featureGate="",enum=PublicKey;FulcioCAWithRekor
-// +openshift:validation:FeatureGateAwareEnum:featureGate=SigstoreImageVerificationPKI,enum=PublicKey;FulcioCAWithRekor;PKI
+// +kubebuilder:validation:Enum=PublicKey;FulcioCAWithRekor;PKI
 type PolicyType string
 
 const (
@@ -199,7 +196,6 @@ type ImagePolicyPKIRootOfTrust struct {
 
 // PKICertificateSubject defines the requirements imposed on the subject to which the certificate was issued.
 // +kubebuilder:validation:XValidation:rule="has(self.email) || has(self.hostname)", message="at least one of email or hostname must be set in pkiCertificateSubject"
-// +openshift:enable:FeatureGate=SigstoreImageVerificationPKI
 type PKICertificateSubject struct {
 	// email specifies the expected email address imposed on the subject to which the certificate was issued, and must match the email address listed in the Subject Alternative Name (SAN) field of the certificate.
 	// The email must be a valid email address and at most 320 characters in length.

diff --git a/...ig/v1/zz_generated.crd-manifests/0000_10_config-operator_01_clusterimagepolicies.crd.yaml b/...ig/v1/zz_generated.crd-manifests/0000_10_config-operator_01_clusterimagepolicies.crd.yaml
@@ -268,10 +268,6 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
-                    - message: pki is required when policyType is PKI, and forbidden
-                        otherwise
-                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
-                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''
@@ -280,6 +276,10 @@ spec:
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''FulcioCAWithRekor''
                         ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)'
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                   signedIdentity:
                     description: |-
                       signedIdentity is an optional field specifies what image identity the signature claims about the image. This is useful when the image identity in the signature differs from the original image spec, such as when mirror registry is configured for the image scope, the signature from the mirror registry contains the image identity of the mirror instead of the original scope.

diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_imagepolicies.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_imagepolicies.crd.yaml
@@ -268,10 +268,6 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
-                    - message: pki is required when policyType is PKI, and forbidden
-                        otherwise
-                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
-                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''
@@ -280,6 +276,10 @@ spec:
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''FulcioCAWithRekor''
                         ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)'
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                   signedIdentity:
                     description: |-
                       signedIdentity is an optional field specifies what image identity the signature claims about the image. This is useful when the image identity in the signature differs from the original image spec, such as when mirror registry is configured for the image scope, the signature from the mirror registry contains the image identity of the mirror instead of the original scope.

diff --git a/config/v1/zz_generated.featuregated-crd-manifests.yaml b/config/v1/zz_generated.featuregated-crd-manifests.yaml
@@ -99,9 +99,7 @@ clusterimagepolicies.config.openshift.io:
   CRDName: clusterimagepolicies.config.openshift.io
   Capability: ""
   Category: ""
-  FeatureGates:
-  - SigstoreImageVerification
-  - SigstoreImageVerificationPKI
+  FeatureGates: []
   FilenameOperatorName: config-operator
   FilenameOperatorOrdering: "01"
   FilenameRunLevel: "0000_10"
@@ -113,8 +111,7 @@ clusterimagepolicies.config.openshift.io:
   PrinterColumns: []
   Scope: Cluster
   ShortNames: null
-  TopLevelFeatureGates:
-  - SigstoreImageVerification
+  TopLevelFeatureGates: []
   Version: v1
 
 clusteroperators.config.openshift.io:
@@ -345,9 +342,7 @@ imagepolicies.config.openshift.io:
   CRDName: imagepolicies.config.openshift.io
   Capability: ""
   Category: ""
-  FeatureGates:
-  - SigstoreImageVerification
-  - SigstoreImageVerificationPKI
+  FeatureGates: []
   FilenameOperatorName: config-operator
   FilenameOperatorOrdering: "01"
   FilenameRunLevel: "0000_10"
@@ -359,8 +354,7 @@ imagepolicies.config.openshift.io:
   PrinterColumns: []
   Scope: Namespaced
   ShortNames: null
-  TopLevelFeatureGates:
-  - SigstoreImageVerification
+  TopLevelFeatureGates: []
   Version: v1
 
 imagetagmirrorsets.config.openshift.io:

diff --git a/...hift.io/SigstoreImageVerificationPKI.yaml → ...cies.config.openshift.io/AAA_ungated.yaml b/...hift.io/SigstoreImageVerificationPKI.yaml → ...cies.config.openshift.io/AAA_ungated.yaml
@@ -6,7 +6,7 @@ metadata:
     api.openshift.io/filename-cvo-runlevel: "0000_10"
     api.openshift.io/filename-operator: config-operator
     api.openshift.io/filename-ordering: "01"
-    feature-gate.release.openshift.io/SigstoreImageVerificationPKI: "true"
+    feature-gate.release.openshift.io/: "true"
   name: clusterimagepolicies.config.openshift.io
 spec:
   group: config.openshift.io
@@ -269,10 +269,6 @@ spec:
                     - policyType
                     type: object
                     x-kubernetes-validations:
-                    - message: pki is required when policyType is PKI, and forbidden
-                        otherwise
-                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
-                        has(self.pki) : !has(self.pki)'
                     - message: publicKey is required when policyType is PublicKey,
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''PublicKey''
@@ -281,6 +277,10 @@ spec:
                         and forbidden otherwise
                       rule: 'has(self.policyType) && self.policyType == ''FulcioCAWithRekor''
                         ? has(self.fulcioCAWithRekor) : !has(self.fulcioCAWithRekor)'
+                    - message: pki is required when policyType is PKI, and forbidden
+                        otherwise
+                      rule: 'has(self.policyType) && self.policyType == ''PKI'' ?
+                        has(self.pki) : !has(self.pki)'
                   signedIdentity:
                     description: |-
                       signedIdentity is an optional field specifies what image identity the signature claims about the image. This is useful when the image identity in the signature differs from the original image spec, such as when mirror registry is configured for the image scope, the signature from the mirror registry contains the image identity of the mirror instead of the original scope.