tls: wire signer certs to read PKI config via SignerKeyParams

Introduce SignerKeyParams, a WritableAsset with zero dependencies that
reads install-config.yaml via AssetBase.LoadFromFile (strict YAML,
deprecated field conversion, defaults) and extracts the effective PKI
configuration via EffectiveSignerPKIConfig(). When no install-config
is present, Load() returns (false, nil) so the asset store falls back to
the state file between multi-step invocations (e.g. create manifests
followed by create cluster, where install-config.yaml is consumed after
the first step). In the agent flow where neither file nor state exists,
Generate() leaves PKIConfig nil (RSA-2048).

SignerKeyParams is explicitly added to the Manifests and agent
target asset lists so that its PKIConfig is persisted to the state
file, ensuring correct key algorithms in multi-step flows where
install-config.yaml is consumed between commands.

Signers that previously had zero dependencies now depend on
SignerKeyParams instead of InstallConfig, avoiding validation that
would reject configs valid in the agent flow. Signers that already
depended on InstallConfig use EffectiveSignerPKIConfig() to resolve
the effective PKI config including feature gate defaults.

With TechPreview enabled and no explicit pki config, all signer certs
are generated with RSA-4096 (the current DefaultPKIProfile default).

Assisted-by: Claude Code (Opus 4.6)

Author: hasbro17

cmd/openshift-install/agent.go

@@ -57,6 +57,7 @@ var (
 			&manifests.AgentManifests{},
 			&mirror.RegistriesConf{},
 			&mirror.CaBundle{},
+			&tls.SignerKeyParams{},
 		},
 	}
 

pkg/asset/ignition/machine/arbiter_ignition_customizations_test.go

@@ -85,8 +85,10 @@ func TestArbiterIgnitionCustomizationsGenerate(t *testing.T) {
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
+			rootCAParents := asset.Parents{}
+			rootCAParents.Add(&tls.SignerKeyParams{})
 			rootCA := &tls.RootCA{}
-			err := rootCA.Generate(context.Background(), nil)
+			err := rootCA.Generate(context.Background(), rootCAParents)
 			assert.NoError(t, err, "unexpected error generating root CA")
 
 			parents := asset.Parents{}

pkg/asset/ignition/machine/arbiter_test.go

@@ -70,8 +70,10 @@ func TestArbiterGenerate(t *testing.T) {
 	}
 	for _, tc := range testCases {
 		t.Run(tc.description, func(t *testing.T) {
+			rootCAParents := asset.Parents{}
+			rootCAParents.Add(&tls.SignerKeyParams{})
 			rootCA := &tls.RootCA{}
-			err := rootCA.Generate(context.Background(), nil)
+			err := rootCA.Generate(context.Background(), rootCAParents)
 			assert.NoError(t, err, "unexpected error generating root CA")
 
 			parents := asset.Parents{}

pkg/asset/ignition/machine/master_ignition_customizations_test.go

@@ -48,8 +48,10 @@ func TestMasterIgnitionCustomizationsGenerate(t *testing.T) {
 					},
 				})
 
+			rootCAParents := asset.Parents{}
+			rootCAParents.Add(&tls.SignerKeyParams{})
 			rootCA := &tls.RootCA{}
-			err := rootCA.Generate(context.Background(), nil)
+			err := rootCA.Generate(context.Background(), rootCAParents)
 			assert.NoError(t, err, "unexpected error generating root CA")
 
 			parents := asset.Parents{}

pkg/asset/ignition/machine/master_test.go

@@ -38,8 +38,10 @@ func TestMasterGenerate(t *testing.T) {
 			},
 		})
 
+	rootCAParents := asset.Parents{}
+	rootCAParents.Add(&tls.SignerKeyParams{})
 	rootCA := &tls.RootCA{}
-	err := rootCA.Generate(context.Background(), nil)
+	err := rootCA.Generate(context.Background(), rootCAParents)
 	assert.NoError(t, err, "unexpected error generating root CA")
 
 	parents := asset.Parents{}

pkg/asset/ignition/machine/worker_ignition_customizations_test.go

@@ -48,8 +48,10 @@ func TestWorkerIgnitionCustomizationsGenerate(t *testing.T) {
 					},
 				})
 
+			rootCAParents := asset.Parents{}
+			rootCAParents.Add(&tls.SignerKeyParams{})
 			rootCA := &tls.RootCA{}
-			err := rootCA.Generate(context.Background(), nil)
+			err := rootCA.Generate(context.Background(), rootCAParents)
 			assert.NoError(t, err, "unexpected error generating root CA")
 
 			parents := asset.Parents{}

pkg/asset/ignition/machine/worker_test.go

@@ -28,8 +28,10 @@ func TestWorkerGenerate(t *testing.T) {
 			},
 		})
 
+	rootCAParents := asset.Parents{}
+	rootCAParents.Add(&tls.SignerKeyParams{})
 	rootCA := &tls.RootCA{}
-	err := rootCA.Generate(context.Background(), nil)
+	err := rootCA.Generate(context.Background(), rootCAParents)
 	assert.NoError(t, err, "unexpected error generating root CA")
 
 	parents := asset.Parents{}

pkg/asset/store/assetcreate_test.go

@@ -126,6 +126,7 @@ func TestCreatedAssetsAreNotDirty(t *testing.T) {
 				"Kubeadmin Password":                     true, // read-only
 				"InternalReleaseImageTLSSecret":          true, // no files when NoRegistryClusterInstall feature gate is not set
 				"InternalReleaseImageRegistryAuthSecret": true, // no files when NoRegistryClusterInstall feature gate is not set
+				"Signer Key Parameters":                  true, // no on-disk files; persisted via state file only
 			}
 			for _, a := range tc.targets {
 				name := a.Name()

pkg/asset/targets/targets.go

@@ -33,6 +33,7 @@ var (
 		&manifests.Manifests{},
 		&manifests.Openshift{},
 		&clusterapi.Cluster{},
+		&tls.SignerKeyParams{},
 	}
 
 	// ManifestTemplates are the manifest-templates targeted assets.

pkg/asset/tls/adminkubeconfig.go

@@ -15,21 +15,28 @@ type AdminKubeConfigSignerCertKey struct {
 
 var _ asset.WritableAsset = (*AdminKubeConfigSignerCertKey)(nil)
 
-// Dependencies returns the dependency of the root-ca, which is empty.
+// Dependencies returns SignerKeyParams. Configurable PKI requires
+// reading the PKI config from InstallConfig, but adding InstallConfig
+// as a dependency here would break codepaths that generate signer certs
+// without an install-config on disk (e.g. agent create certificates,
+// node-joiner). SignerKeyParams reads the config directly from disk
+// without triggering InstallConfig validation.
 func (c *AdminKubeConfigSignerCertKey) Dependencies() []asset.Asset {
-	return []asset.Asset{}
+	return []asset.Asset{&SignerKeyParams{}}
 }
 
 // Generate generates the root-ca key and cert pair.
 func (c *AdminKubeConfigSignerCertKey) Generate(ctx context.Context, parents asset.Parents) error {
+	signerKeyParams := &SignerKeyParams{}
+	parents.Get(signerKeyParams)
 	cfg := &CertCfg{
 		Subject: pkix.Name{CommonName: "admin-kubeconfig-signer", OrganizationalUnit: []string{"openshift"}},
 		// KeyUsages is set by GenerateSelfSignedCertificate based on the key algorithm.
 		Validity: ValidityTenYears(),
 		IsCA:     true,
 	}
 
-	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", nil)
+	return c.SelfSignedCertKey.Generate(ctx, cfg, "admin-kubeconfig-signer", signerKeyParams.PKIConfig)
 }
 
 // Load reads the asset files from disk.