openshift · openshift-merge-bot · Apr 6, 2026 · Mar 31, 2026 · Mar 31, 2026 · Mar 31, 2026
diff --git a/api/operator/v1alpha1/features.go b/api/operator/v1alpha1/features.go
@@ -5,7 +5,7 @@ import (
 )
 
 var (
-	// IstioCSR enables the controller for istiocsr.operator.openshift.io resource,
+	// FeatureIstioCSR enables the controller for istiocsr.operator.openshift.io resource,
 	// which extends cert-manager-operator to deploy and manage the istio-csr agent.
 	// OpenShift Service Mesh facilitates the integration and istio-csr is an agent that
 	// allows Istio workload and control plane components to be secured using cert-manager.
@@ -14,7 +14,7 @@ var (
 	// https://github.com/openshift/enhancements/blob/master/enhancements/cert-manager/istio-csr-controller.md
 	FeatureIstioCSR featuregate.Feature = "IstioCSR"
 
-	// TrustManager enables the controller for trustmanagers.operator.openshift.io resource,
+	// FeatureTrustManager enables the controller for trustmanagers.operator.openshift.io resource,
 	// which extends cert-manager-operator to deploy and manage the trust-manager operand.
 	// trust-manager provides a way to manage trust bundles in OpenShift clusters.
 	//

diff --git a/bundle/manifests/cert-manager-operator.clusterserviceversion.yaml b/bundle/manifests/cert-manager-operator.clusterserviceversion.yaml
@@ -407,6 +407,12 @@ spec:
     spec:
       clusterPermissions:
       - rules:
+        - apiGroups:
+          - config.openshift.io
+          resources:
+          - featuregates
+          verbs:
+          - get
         - apiGroups:
           - ""
           resources:

diff --git a/config/rbac/featuregate_clusterrole.yaml b/config/rbac/featuregate_clusterrole.yaml
@@ -0,0 +1,17 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/name: featuregate-reader
+    app.kubernetes.io/instance: featuregate-reader
+    app.kubernetes.io/created-by: cert-manager-operator
+    app.kubernetes.io/part-of: cert-manager-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: featuregate-reader
+rules:
+- apiGroups:
+  - config.openshift.io
+  resources:
+  - featuregates
+  verbs:
+  - get
diff --git a/config/rbac/featuregate_clusterrole_binding.yaml b/config/rbac/featuregate_clusterrole_binding.yaml
@@ -0,0 +1,18 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/name: featuregate-reader
+    app.kubernetes.io/instance: featuregate-reader
+    app.kubernetes.io/created-by: cert-manager-operator
+    app.kubernetes.io/part-of: cert-manager-operator
+    app.kubernetes.io/managed-by: kustomize
+  name: featuregate-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: featuregate-reader
+subjects:
+- kind: ServiceAccount
+  name: controller-manager
+  namespace: system
diff --git a/config/rbac/kustomization.yaml b/config/rbac/kustomization.yaml
@@ -15,3 +15,7 @@ resources:
 - auth_proxy_role.yaml
 - auth_proxy_role_binding.yaml
 - auth_proxy_client_clusterrole.yaml
+# RBAC for reading featuregates.config.openshift.io resource to determine
+# feature enabling.
+- featuregate_clusterrole.yaml
+- featuregate_clusterrole_binding.yaml
diff --git a/...ent/cert_manager_cainjector_deployment.go → ...ger/cert_manager_cainjector_deployment.go b/...ent/cert_manager_cainjector_deployment.go → ...ger/cert_manager_cainjector_deployment.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"k8s.io/client-go/informers"
@@ -14,7 +14,7 @@ import (
 
 	"github.com/openshift/cert-manager-operator/pkg/operator/assets"
 	certmanoperatorinformers "github.com/openshift/cert-manager-operator/pkg/operator/informers/externalversions"
-	"github.com/openshift/cert-manager-operator/pkg/operator/optionalinformer"
+	"github.com/openshift/cert-manager-operator/pkg/operator/utils"
 )
 
 const (
@@ -51,7 +51,7 @@ func NewCertManagerCAInjectorStaticResourcesController(operatorClient v1helpers.
 
 func NewCertManagerCAInjectorDeploymentController(operatorClient v1helpers.OperatorClientWithFinalizers,
 	certManagerOperatorInformers certmanoperatorinformers.SharedInformerFactory,
-	infraInformers optionalinformer.OptionalInformer[configinformers.SharedInformerFactory],
+	infraInformers utils.OptionalInformer[configinformers.SharedInformerFactory],
 	kubeClient kubernetes.Interface,
 	kubeInformersForTargetNamespace informers.SharedInformerFactory,
 	eventsRecorder events.Recorder, targetVersion string, versionRecorder status.VersionGetter,

diff --git a/...ent/cert_manager_controller_deployment.go → ...ger/cert_manager_controller_deployment.go b/...ent/cert_manager_controller_deployment.go → ...ger/cert_manager_controller_deployment.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"k8s.io/client-go/informers"
@@ -14,7 +14,7 @@ import (
 
 	"github.com/openshift/cert-manager-operator/pkg/operator/assets"
 	certmanoperatorinformers "github.com/openshift/cert-manager-operator/pkg/operator/informers/externalversions"
-	"github.com/openshift/cert-manager-operator/pkg/operator/optionalinformer"
+	"github.com/openshift/cert-manager-operator/pkg/operator/utils"
 )
 
 const (
@@ -70,11 +70,12 @@ func NewCertManagerControllerStaticResourcesController(operatorClient v1helpers.
 
 func NewCertManagerControllerDeploymentController(operatorClient v1helpers.OperatorClientWithFinalizers,
 	certManagerOperatorInformers certmanoperatorinformers.SharedInformerFactory,
-	infraInformers optionalinformer.OptionalInformer[configinformers.SharedInformerFactory],
+	infraInformers utils.OptionalInformer[configinformers.SharedInformerFactory],
 	kubeClient kubernetes.Interface,
 	kubeInformersForTargetNamespace informers.SharedInformerFactory,
 	eventsRecorder events.Recorder, targetVersion string, versionRecorder status.VersionGetter, trustedCAConfigmapName, cloudCredentialsSecretName string) factory.Controller {
 	return newGenericDeploymentController(
+
 		certManagerControllerDeploymentControllerName,
 		targetVersion,
 		certManagerControllerDeploymentFile,

diff --git a/...deployment/cert_manager_controller_set.go → ...ertmanager/cert_manager_controller_set.go b/...deployment/cert_manager_controller_set.go → ...ertmanager/cert_manager_controller_set.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"k8s.io/client-go/informers"
@@ -12,7 +12,7 @@ import (
 	"github.com/openshift/library-go/pkg/operator/v1helpers"
 
 	certmanoperatorinformers "github.com/openshift/cert-manager-operator/pkg/operator/informers/externalversions"
-	"github.com/openshift/cert-manager-operator/pkg/operator/optionalinformer"
+	"github.com/openshift/cert-manager-operator/pkg/operator/utils"
 )
 
 type CertManagerControllerSet struct {
@@ -30,7 +30,7 @@ func NewCertManagerControllerSet(
 	kubeClient kubernetes.Interface,
 	kubeInformersForNamespaces v1helpers.KubeInformersForNamespaces,
 	kubeInformersForTargetNamespace informers.SharedInformerFactory,
-	infraInformers optionalinformer.OptionalInformer[configinformers.SharedInformerFactory],
+	infraInformers utils.OptionalInformer[configinformers.SharedInformerFactory],
 	operatorClient v1helpers.OperatorClientWithFinalizers,
 	certManagerOperatorInformers certmanoperatorinformers.SharedInformerFactory,
 	kubeClientContainer *resourceapply.ClientHolder,

diff --git a/.../deployment/cert_manager_networkpolicy.go → ...certmanager/cert_manager_networkpolicy.go b/.../deployment/cert_manager_networkpolicy.go → ...certmanager/cert_manager_networkpolicy.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"context"

diff --git a/...oyment/cert_manager_webhook_deployment.go → ...anager/cert_manager_webhook_deployment.go b/...oyment/cert_manager_webhook_deployment.go → ...anager/cert_manager_webhook_deployment.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"k8s.io/client-go/informers"
@@ -14,7 +14,7 @@ import (
 
 	"github.com/openshift/cert-manager-operator/pkg/operator/assets"
 	certmanoperatorinformers "github.com/openshift/cert-manager-operator/pkg/operator/informers/externalversions"
-	"github.com/openshift/cert-manager-operator/pkg/operator/optionalinformer"
+	"github.com/openshift/cert-manager-operator/pkg/operator/utils"
 )
 
 const (
@@ -52,7 +52,7 @@ func NewCertManagerWebhookStaticResourcesController(operatorClient v1helpers.Ope
 
 func NewCertManagerWebhookDeploymentController(operatorClient v1helpers.OperatorClientWithFinalizers,
 	certManagerOperatorInformers certmanoperatorinformers.SharedInformerFactory,
-	infraInformers optionalinformer.OptionalInformer[configinformers.SharedInformerFactory],
+	infraInformers utils.OptionalInformer[configinformers.SharedInformerFactory],
 	kubeclient kubernetes.Interface,
 	kubeInformersForTargetNamespace informers.SharedInformerFactory,
 	eventsRecorder events.Recorder, targetVersion string, versionRecorder status.VersionGetter, trustedCAConfigmapName, cloudCredentialsSecretName string) factory.Controller {

diff --git a/...ller/deployment/certmanager_controller.go → ...ler/certmanager/certmanager_controller.go b/...ller/deployment/certmanager_controller.go → ...ler/certmanager/certmanager_controller.go
@@ -14,7 +14,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 */
 
-package deployment
+package certmanager
 
 import (
 	"context"

diff --git a/pkg/controller/deployment/common.go → pkg/controller/certmanager/common.go b/pkg/controller/deployment/common.go → pkg/controller/certmanager/common.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 const (
 	operatorName      = "cert-manager"

diff --git a/...troller/deployment/credentials_request.go → ...roller/certmanager/credentials_request.go b/...troller/deployment/credentials_request.go → ...roller/certmanager/credentials_request.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"fmt"

diff --git a/...oyment/default_cert_manager_controller.go → ...anager/default_cert_manager_controller.go b/...oyment/default_cert_manager_controller.go → ...anager/default_cert_manager_controller.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"context"

diff --git a/...ontroller/deployment/deployment_helper.go → ...ntroller/certmanager/deployment_helper.go b/...ontroller/deployment/deployment_helper.go → ...ntroller/certmanager/deployment_helper.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"fmt"

diff --git a/...ller/deployment/deployment_helper_test.go → ...ler/certmanager/deployment_helper_test.go b/...ller/deployment/deployment_helper_test.go → ...ler/certmanager/deployment_helper_test.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"testing"

diff --git a/...roller/deployment/deployment_log_level.go → ...oller/certmanager/deployment_log_level.go b/...roller/deployment/deployment_log_level.go → ...oller/certmanager/deployment_log_level.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	appsv1 "k8s.io/api/apps/v1"

diff --git a/...roller/deployment/deployment_overrides.go → ...oller/certmanager/deployment_overrides.go b/...roller/deployment/deployment_overrides.go → ...oller/certmanager/deployment_overrides.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"fmt"

diff --git a/...r/deployment/deployment_overrides_test.go → .../certmanager/deployment_overrides_test.go b/...r/deployment/deployment_overrides_test.go → .../certmanager/deployment_overrides_test.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"reflect"

diff --git a/...oyment/deployment_overrides_validation.go → ...anager/deployment_overrides_validation.go b/...oyment/deployment_overrides_validation.go → ...anager/deployment_overrides_validation.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"fmt"

diff --git a/...t/deployment_overrides_validation_test.go → ...r/deployment_overrides_validation_test.go b/...t/deployment_overrides_validation_test.go → ...r/deployment_overrides_validation_test.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"testing"

diff --git a/...yment/deployment_unsupported_overrides.go → ...nager/deployment_unsupported_overrides.go b/...yment/deployment_unsupported_overrides.go → ...nager/deployment_unsupported_overrides.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"encoding/json"

diff --git a/...ployment/generic_deployment_controller.go → ...tmanager/generic_deployment_controller.go b/...ployment/generic_deployment_controller.go → ...tmanager/generic_deployment_controller.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"k8s.io/client-go/informers"
@@ -14,14 +14,14 @@ import (
 
 	"github.com/openshift/cert-manager-operator/pkg/operator/assets"
 	certmanoperatorinformers "github.com/openshift/cert-manager-operator/pkg/operator/informers/externalversions"
-	"github.com/openshift/cert-manager-operator/pkg/operator/optionalinformer"
+	"github.com/openshift/cert-manager-operator/pkg/operator/utils"
 )
 
 func newGenericDeploymentController(
 	controllerName, targetVersion, deploymentFile string,
 	operatorClient v1helpers.OperatorClientWithFinalizers,
 	certManagerOperatorInformers certmanoperatorinformers.SharedInformerFactory,
-	infraInformers optionalinformer.OptionalInformer[configinformers.SharedInformerFactory],
+	infraInformers utils.OptionalInformer[configinformers.SharedInformerFactory],
 	kubeClient kubernetes.Interface,
 	kubeInformersForTargetNamespace informers.SharedInformerFactory,
 	eventsRecorder events.Recorder,

diff --git a/pkg/controller/deployment/related_images.go → pkg/controller/certmanager/related_images.go b/pkg/controller/deployment/related_images.go → pkg/controller/certmanager/related_images.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"os"

diff --git a/...troller/deployment/related_images_test.go → ...roller/certmanager/related_images_test.go b/...troller/deployment/related_images_test.go → ...roller/certmanager/related_images_test.go
@@ -1,4 +1,4 @@
-package deployment
+package certmanager
 
 import (
 	"os"