From cc8de72702d65cb56b0d6a66aac16399a672410b Mon Sep 17 00:00:00 2001 From: Krzysztof Ostrowski Date: Fri, 21 Aug 2026 18:18:12 +0200 Subject: [PATCH 1/2] OCPBUGS-74507: Remove ServiceAccountTokenNodeBinding feature gate The upstream Kubernetes gate ServiceAccountTokenNodeBinding has been GA and locked to its default (true) since 1.33. OpenShift's explicit enablement is therefore a no-op and the gate can be dropped from the OpenShift feature gate registry. --- features/features.go | 8 -------- 1 file changed, 8 deletions(-) diff --git a/features/features.go b/features/features.go index 9e1150f2d6a..75ecb16fa3c 100644 --- a/features/features.go +++ b/features/features.go @@ -75,14 +75,6 @@ func AllFeatureSets() map[uint64]map[ClusterProfileName]map[configv1.FeatureSet] var ( allFeatureGates = map[configv1.FeatureGateName][]featureGateStatus{} - FeatureGateServiceAccountTokenNodeBinding = newFeatureGate("ServiceAccountTokenNodeBinding"). - reportProblemsToJiraComponent("apiserver-auth"). - contactPerson("ibihim"). - productScope(kubernetes). - enhancementPR("https://github.com/kubernetes/enhancements/issues/4193"). - enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()). - mustRegister() - FeatureGateMutatingAdmissionPolicy = newFeatureGate("MutatingAdmissionPolicy"). reportProblemsToJiraComponent("kube-apiserver"). contactPerson("benluddy"). From 734fe96dc6d6d5bf9f6c7caf44484e7bfc8a0044 Mon Sep 17 00:00:00 2001 From: Krzysztof Ostrowski Date: Fri, 21 Aug 2026 18:18:51 +0200 Subject: [PATCH 2/2] OCPBUGS-74507: Regenerate feature gate payload manifests make update-payload-featuregates --- features.md | 1 - .../featuregates/featureGate-4-10-Hypershift-Default.yaml | 3 --- .../featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml | 3 --- .../featuregates/featureGate-4-10-Hypershift-OKD.yaml | 3 --- .../featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml | 3 --- .../featuregates/featureGate-4-10-SelfManagedHA-Default.yaml | 3 --- .../featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml | 3 --- .../featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml | 3 --- .../featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml | 3 --- 9 files changed, 25 deletions(-) diff --git a/features.md b/features.md index 5740fc034fb..1331478aaea 100644 --- a/features.md +++ b/features.md @@ -116,7 +116,6 @@ | OSStreams| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | OpenShiftPodSecurityAdmission| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SELinuxMountGAReadiness| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | -| ServiceAccountTokenNodeBinding| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SigstoreImageVerification| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | SigstoreImageVerificationPKI| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | | StoragePerformantSecurityPolicy| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml index fc3a3dc3a30..ca92d50f87a 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml @@ -364,9 +364,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SigstoreImageVerification" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml index a857545a423..404e447c22e 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml @@ -351,9 +351,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SignatureStores" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml index 1513fbdf881..2b886e7a0ff 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml @@ -366,9 +366,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SigstoreImageVerification" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml index 0aef14ca1a4..c644ea11921 100644 --- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml @@ -351,9 +351,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SignatureStores" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml index 662bcb95df8..c01b8cd5d37 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml @@ -364,9 +364,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SigstoreImageVerification" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml index 89c1963d9da..a17c06084aa 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml @@ -351,9 +351,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SignatureStores" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml index 1396a78cd0f..5ba476c1ab1 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml @@ -366,9 +366,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SigstoreImageVerification" }, diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml index 0ae832f15bd..6999a17ab73 100644 --- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml +++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml @@ -351,9 +351,6 @@ { "name": "SELinuxMountGAReadiness" }, - { - "name": "ServiceAccountTokenNodeBinding" - }, { "name": "SignatureStores" },