tls: add SignerKeyParams asset to decouple signer certs from InstallConfig

The TLS refactor for configurable PKI added InstallConfig as a
dependency to 4 signer certificates that previously had none. This
broke codepaths that generate signer certs without an install-config
on disk, such as `agent create certificates` (used by set-node-zero.sh
in UI-based agent installs) and `node-joiner add-nodes`. It also broke
the agent flow for configs that pass agent-specific validation but fail
standard InstallConfig validation (e.g. vSphere without credentials).

Introduce a SignerKeyParams WritableAsset with zero dependencies that
reads install-config.yaml directly from disk in Load(), extracting only
the PKI and FeatureSet fields without running validation. This avoids
pulling standard InstallConfig validation into the agent flow, where
OptionalInstallConfig handles validation with more lenient rules.
When no install-config is present, Load() defaults to nil PKIConfig
(RSA-2048).

Assisted-by: Claude Code (Opus 4.6)

Author: hasbro17

pkg/asset/tls/adminkubeconfig.go

@@ -6,8 +6,6 @@ import (
 	"crypto/x509/pkix"
 
 	"github.com/openshift/installer/pkg/asset"
-	"github.com/openshift/installer/pkg/asset/installconfig"
-	pkidefaults "github.com/openshift/installer/pkg/types/pki"
 )
 
 // AdminKubeConfigSignerCertKey is a key/cert pair that signs the admin kubeconfig client certs.
@@ -19,21 +17,21 @@ var _ asset.WritableAsset = (*AdminKubeConfigSignerCertKey)(nil)
 
 // Dependencies returns the dependency of the root-ca, which is empty.
 func (c *AdminKubeConfigSignerCertKey) Dependencies() []asset.Asset {
-	return []asset.Asset{&installconfig.InstallConfig{}}
+	return []asset.Asset{&SignerKeyParams{}}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *AdminKubeConfigSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
-	installConfig := &installconfig.InstallConfig{}
-	parents.Get(installConfig)
+	signerKeyParams := &SignerKeyParams{}
+	parents.Get(signerKeyParams)
 	cfg := &CertCfg{
 		Subject: pkix.Name{CommonName: "admin-kubeconfig-signer", OrganizationalUnit: []string{"openshift"}},
 		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
 		Validity: ValidityTenYears(),
 		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", signerKeyParams.PKIConfig)
 }
 
 // Load reads the asset files from disk.

pkg/asset/tls/apiserver.go

@@ -119,21 +119,21 @@ var _ asset.WritableAsset = (*KubeAPIServerLocalhostSignerCertKey)(nil)
 
 // Dependencies returns the dependency of the root-ca, which is empty.
 func (c *KubeAPIServerLocalhostSignerCertKey) Dependencies() []asset.Asset {
-	return []asset.Asset{&installconfig.InstallConfig{}}
+	return []asset.Asset{&SignerKeyParams{}}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *KubeAPIServerLocalhostSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
-	installConfig := &installconfig.InstallConfig{}
-	parents.Get(installConfig)
+	signerKeyParams := &SignerKeyParams{}
+	parents.Get(signerKeyParams)
 	cfg := &CertCfg{
 		Subject: pkix.Name{CommonName: "kube-apiserver-localhost-signer", OrganizationalUnit: []string{"openshift"}},
 		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
 		Validity: ValidityTenYears(),
 		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-localhost-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-localhost-signer", signerKeyParams.PKIConfig)
 }
 
 // Load reads the asset files from disk.
@@ -225,21 +225,21 @@ var _ asset.WritableAsset = (*KubeAPIServerServiceNetworkSignerCertKey)(nil)
 
 // Dependencies returns the dependency of the root-ca, which is empty.
 func (c *KubeAPIServerServiceNetworkSignerCertKey) Dependencies() []asset.Asset {
-	return []asset.Asset{&installconfig.InstallConfig{}}
+	return []asset.Asset{&SignerKeyParams{}}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *KubeAPIServerServiceNetworkSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
-	installConfig := &installconfig.InstallConfig{}
-	parents.Get(installConfig)
+	signerKeyParams := &SignerKeyParams{}
+	parents.Get(signerKeyParams)
 	cfg := &CertCfg{
 		Subject: pkix.Name{CommonName: "kube-apiserver-service-network-signer", OrganizationalUnit: []string{"openshift"}},
 		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
 		Validity: ValidityTenYears(),
 		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-service-network-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-service-network-signer", signerKeyParams.PKIConfig)
 }
 
 // Load reads the asset files from disk.
@@ -340,21 +340,21 @@ var _ asset.WritableAsset = (*KubeAPIServerLBSignerCertKey)(nil)
 
 // Dependencies returns the dependency of the root-ca, which is empty.
 func (c *KubeAPIServerLBSignerCertKey) Dependencies() []asset.Asset {
-	return []asset.Asset{&installconfig.InstallConfig{}}
+	return []asset.Asset{&SignerKeyParams{}}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *KubeAPIServerLBSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
-	installConfig := &installconfig.InstallConfig{}
-	parents.Get(installConfig)
+	signerKeyParams := &SignerKeyParams{}
+	parents.Get(signerKeyParams)
 	cfg := &CertCfg{
 		Subject: pkix.Name{CommonName: "kube-apiserver-lb-signer", OrganizationalUnit: []string{"openshift"}},
 		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
 		Validity: ValidityTenYears(),
 		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-lb-signer", pkidefaults.EffectiveSignerPKIConfig(installConfig.Config))
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "kube-apiserver-lb-signer", signerKeyParams.PKIConfig)
 }
 
 // Load reads the asset files from disk.

pkg/asset/tls/signerkey_params.go

@@ -0,0 +1,75 @@
+package tls
+
+import (
+	"context"
+
+	"sigs.k8s.io/yaml"
+
+	"github.com/openshift/installer/pkg/asset"
+	"github.com/openshift/installer/pkg/types"
+	pkidefaults "github.com/openshift/installer/pkg/types/pki"
+)
+
+// SignerKeyParams resolves the effective PKI configuration for signer
+// certificates. It has no asset dependencies and reads install-config.yaml
+// directly from disk so that signer certs can be generated without triggering
+// standard InstallConfig validation. When no install-config is present (e.g.
+// agent create certificates, node-joiner add-nodes), it defaults to nil
+// PKIConfig which maps to RSA-2048.
+type SignerKeyParams struct {
+	PKIConfig *types.PKIConfig
+}
+
+var _ asset.WritableAsset = (*SignerKeyParams)(nil)
+
+// Name returns a human-friendly name for the asset.
+func (*SignerKeyParams) Name() string {
+	return "Signer Key Parameters"
+}
+
+// Dependencies returns no dependencies. See Load() for why this asset does
+// not depend on the standard InstallConfig asset.
+func (*SignerKeyParams) Dependencies() []asset.Asset {
+	return []asset.Asset{}
+}
+
+// Generate is a no-op. PKI config is resolved entirely in Load().
+func (s *SignerKeyParams) Generate(_ context.Context, _ asset.Parents) error {
+	return nil
+}
+
+// Files returns nil — this asset has no on-disk representation.
+func (*SignerKeyParams) Files() []*asset.File {
+	return nil
+}
+
+// Load reads the install-config.yaml directly from disk and extracts the PKI
+// configuration. This always returns (true, nil) — it never errors and never
+// triggers interactive prompts.
+//
+// We parse the install-config directly rather than depending on the
+// InstallConfig asset because store.load() recursively loads all dependencies
+// from disk, and InstallConfig.Load() runs full platform validation via
+// finish() -> ValidateInstallConfig(). In the agent flow, configs are validated
+// by OptionalInstallConfig with agent-specific rules that are more lenient
+// (e.g. vSphere without credentials is valid for agent installs). Adding
+// InstallConfig as a dependency here would pull standard validation into the
+// agent flow, rejecting configs that OptionalInstallConfig accepts.
+//
+// Since we only need the PKI and FeatureSet fields, we can safely unmarshal
+// without validation. Any actual validation errors will be caught by the
+// authoritative InstallConfig or OptionalInstallConfig asset elsewhere in the
+// pipeline.
+func (s *SignerKeyParams) Load(f asset.FileFetcher) (bool, error) {
+	// Matches installConfigFilename in pkg/asset/installconfig/installconfig.go.
+	file, err := f.FetchByName("install-config.yaml")
+	if err != nil {
+		return true, nil
+	}
+	config := &types.InstallConfig{}
+	if err := yaml.Unmarshal(file.Data, config); err != nil {
+		return true, nil
+	}
+	s.PKIConfig = pkidefaults.EffectiveSignerPKIConfig(config)
+	return true, nil
+}