introduce OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY for upi install on gcp/vsphere/openstack and baremetal install

ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-commands.sh

@@ -182,6 +182,7 @@ fi
 # even on success
 cat - <<EOF >> "${SHARED_DIR}/dev-scripts-additional-config"
 export OPENSHIFT_INSTALL_GATHER_BOOTSTRAP=true
+export OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY=${OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY:-}
 EOF
 
 scp "${SSHOPTS[@]}" "${SHARED_DIR}/dev-scripts-additional-config" "root@${IP}:dev-scripts-additional-config"

ci-operator/step-registry/baremetalds/devscripts/setup/baremetalds-devscripts-setup-ref.yaml

@@ -23,6 +23,9 @@ ref:
   - name: AGENT_E2E_TEST_BOOT_MODE
     default: ""
     documentation: Set the boot mode to DISKIMAGE for using the APPLIANCE_IMAGE
+  - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY
+    default: "true"
+    documentation: "Set to true to disable the Sigstore image signature policy to allow the installation of an unsigned release image. This is for internal CI testing only"
   dependencies:
   - name: "release:latest"
     env: OPENSHIFT_INSTALL_RELEASE_IMAGE

ci-operator/step-registry/upi/install/gcp/upi-install-gcp-ref.yaml

@@ -22,6 +22,9 @@ ref:
     default:  ""
     documentation: |-
       This field represents how to expose the user-facing endpoints like the Kubernetes API, OpenShift routes of the cluster
+  - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY
+    default: "true"
+    documentation: "Set to true to disable the Sigstore image signature policy to allow the installation of an unsigned release image. This is for internal CI testing only"
   documentation: >-
     This step deploys a UPI cluster to the CI GCP project.
     It requires properly configured Ignition, metadata.json, and kubeconfig files to exist in the shared directory.

ci-operator/step-registry/upi/install/openstack/upi-install-openstack-ref.yaml

@@ -16,6 +16,9 @@ ref:
     documentation: |-
       Name of the OpenStack public-facing network. Defaults to the value in
       "${SHARED_DIR}/OPENSTACK_EXTERNAL_NETWORK"
+  - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY
+    default: "true"
+    documentation: "Set to true to disable the Sigstore image signature policy to allow the installation of an unsigned release image. This is for internal CI testing only"
   dependencies:
   - name: "release:latest"
     env: OPENSHIFT_INSTALL_RELEASE_IMAGE_OVERRIDE

ci-operator/step-registry/upi/install/vsphere/upi-install-vsphere-ref.yaml

@@ -28,6 +28,9 @@ ref:
     documentation: |-
       STORAGE_POLICY_ID is used to encrypt VMs for all nodes of cluster on vsphere platform.
       Once assigned, all VMs will be encrypted with this storage policy.
+  - name: OPENSHIFT_INSTALL_EXPERIMENTAL_DISABLE_IMAGE_POLICY
+    default: "true"
+    documentation: "Set to true to disable the Sigstore image signature policy to allow the installation of an unsigned release image. This is for internal CI testing only"
   documentation: >-
     This step deploys a UPI cluster to the CI vSphere project.
     It requires properly configured govc.sh, Ignition, metadata.json, and kubeconfig files to exist in the shared directory.