From ac0a2e4cbaac6022ab4c8b5950b5a47cdaecb585 Mon Sep 17 00:00:00 2001
From: Richard Vanderpool <49568690+rvanderp3@users.noreply.github.com>
Date: Mon, 17 Aug 2026 19:34:26 -0400
Subject: [PATCH] SPLAT-2874: Add VSpherePerComponentCredOverrides feature gate
Adds a new TechPreview feature gate for vSphere per-component
credential overrides in CCO, allowing cluster administrators to
provide distinct, lower-privilege credentials for each component
(Machine API, CSI, Cloud Controller Manager) via annotated secrets
in the openshift-config namespace.
Enhancement: https://github.com/openshift/enhancements/pull/2081
---
features.md | 1 +
features/features.go | 8 ++++++++
.../featuregates/featureGate-4-10-Hypershift-Default.yaml | 3 +++
.../featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml | 3 +++
.../featuregates/featureGate-4-10-Hypershift-OKD.yaml | 3 +++
.../featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml | 3 +++
.../featureGate-4-10-SelfManagedHA-Default.yaml | 3 +++
...eatureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml | 3 +++
.../featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml | 3 +++
...atureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml | 3 +++
10 files changed, 33 insertions(+)
diff --git a/features.md b/features.md
index 9953d8aab36..9547ccc31de 100644
--- a/features.md
+++ b/features.md
@@ -26,6 +26,7 @@
| NewOLMConfigAPI| | | | Enabled | | | | Enabled |
| NewOLMOwnSingleNamespace| | | | Enabled | | | | Enabled |
| ProvisioningRequestAvailable| | | Enabled | Enabled | | | | |
+| VSpherePerComponentScopedCreds| | | Enabled | Enabled | | | | |
| AWSClusterHostedDNS| | | Enabled | Enabled | | | Enabled | Enabled |
| AWSDedicatedHosts| | | Enabled | Enabled | | | Enabled | Enabled |
| AWSEuropeanSovereignCloudInstall| | | Enabled | Enabled | | | Enabled | Enabled |
diff --git a/features/features.go b/features/features.go
index 606c3ee6f6b..636f3724174 100644
--- a/features/features.go
+++ b/features/features.go
@@ -1075,4 +1075,12 @@ var (
enhancementPR("https://github.com/openshift/enhancements/pull/2047").
enable(inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
mustRegister()
+
+ FeatureGateVSpherePerComponentScopedCreds = newFeatureGate("VSpherePerComponentScopedCreds").
+ reportProblemsToJiraComponent("splat").
+ contactPerson("rvanderp3").
+ productScope(ocpSpecific).
+ enhancementPR("https://github.com/openshift/enhancements/pull/2081").
+ enable(inDevPreviewNoUpgrade()).
+ mustRegister()
)
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
index 7e94ae5ee8a..c113f6711ea 100644
--- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
@@ -274,6 +274,9 @@
},
{
"name": "VSphereMultiVCenterDay2"
+ },
+ {
+ "name": "VSpherePerComponentScopedCreds"
}
],
"enabled": [
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
index bf71d6e2492..d953bbfc60a 100644
--- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
@@ -396,6 +396,9 @@
{
"name": "VSphereMultiVCenterDay2"
},
+ {
+ "name": "VSpherePerComponentScopedCreds"
+ },
{
"name": "VolumeGroupSnapshot"
}
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
index b39c936bedf..40722cfe990 100644
--- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
@@ -276,6 +276,9 @@
},
{
"name": "VSphereMultiVCenterDay2"
+ },
+ {
+ "name": "VSpherePerComponentScopedCreds"
}
],
"enabled": [
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
index ed85ae2682e..100321f205b 100644
--- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
@@ -108,6 +108,9 @@
},
{
"name": "ShortCertRotation"
+ },
+ {
+ "name": "VSpherePerComponentScopedCreds"
}
],
"enabled": [
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
index ec86952c5fa..c0bf386833e 100644
--- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
@@ -262,6 +262,9 @@
},
{
"name": "VSphereMultiVCenterDay2"
+ },
+ {
+ "name": "VSpherePerComponentScopedCreds"
}
],
"enabled": [
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
index 0131a4700e9..1b57a515501 100644
--- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
@@ -396,6 +396,9 @@
{
"name": "VSphereMultiVCenterDay2"
},
+ {
+ "name": "VSpherePerComponentScopedCreds"
+ },
{
"name": "VolumeGroupSnapshot"
}
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
index 8dd2d7e168f..04162f145bb 100644
--- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
@@ -264,6 +264,9 @@
},
{
"name": "VSphereMultiVCenterDay2"
+ },
+ {
+ "name": "VSpherePerComponentScopedCreds"
}
],
"enabled": [
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
index cd9d3ca553e..994648bc924 100644
--- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
@@ -81,6 +81,9 @@
},
{
"name": "ShortCertRotation"
+ },
+ {
+ "name": "VSpherePerComponentScopedCreds"
}
],
"enabled": [