OSDOCS-21804: Document that disconnected 4.22 installs require oc-mirror v2 for release image signatures

[Divyanshi-13]

Summary

• Documents that OpenShift 4.22 applies a default ClusterImagePolicy (openshift) to cluster nodes (not bootstrap), which writes sigstoreSigned into /etc/containers/policy.json and is enforced at first boot by machine-config-daemon-pull.service.
• States that oc adm release mirror and oc image mirror do not provide those signatures for first-boot verification, so disconnected installs must use oc-mirror plugin v2 (signatures mirrored by default).
• Clarifies that CVO signature config maps, install-config.yaml, overwriting policy.json, and the SigstoreImageVerification TechPreview feature gate are not the supported path.

Fixes https://issues.redhat.com/browse/OSDOCS-21804
Related: https://issues.redhat.com/browse/OCPBUGS-82580

Test plan

• Preview About disconnected installation mirroring and Mirroring images for a disconnected installation by using the oc adm command for the new first-boot signature section.
• Preview Mirroring images for a disconnected installation by using the oc-mirror plugin v2 and Manage secure signatures with sigstore.
• Confirm the oc adm release mirror deprecation snippet now mentions missing signatures at first boot.
• Confirm the former oc image mirror signature example was removed from the cluster image policy procedure.

Made with Cursor

[openshift-ci-robot]

@Divyanshi-13: This pull request references OSDOCS-21804 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

• Documents that OpenShift 4.22 applies a default ClusterImagePolicy (openshift) to cluster nodes (not bootstrap), which writes sigstoreSigned into /etc/containers/policy.json and is enforced at first boot by machine-config-daemon-pull.service.
• States that oc adm release mirror and oc image mirror do not provide those signatures for first-boot verification, so disconnected installs must use oc-mirror plugin v2 (signatures mirrored by default).
• Clarifies that CVO signature config maps, install-config.yaml, overwriting policy.json, and the SigstoreImageVerification TechPreview feature gate are not the supported path.

Fixes https://issues.redhat.com/browse/OSDOCS-21804
Related: https://issues.redhat.com/browse/OCPBUGS-82580

Test plan

• Preview About disconnected installation mirroring and Mirroring images for a disconnected installation by using the oc adm command for the new first-boot signature section.
• Preview Mirroring images for a disconnected installation by using the oc-mirror plugin v2 and Manage secure signatures with sigstore.
• Confirm the oc adm release mirror deprecation snippet now mentions missing signatures at first boot.
• Confirm the former oc image mirror signature example was removed from the cluster image policy procedure.

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hi @Divyanshi-13. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.