From 6908ee44b669c5ed7d657a67ee0ca20e615d3b2f Mon Sep 17 00:00:00 2001
From: Jan Chaloupka <jchaloup@redhat.com>
Date: Fri, 29 May 2026 00:53:03 +0200
Subject: [PATCH] feat: have CVO inject the centralized TLS configuration into
 the operator's config

Also, have the operator restart whenever the config changes.
---
 manifests/0000_10_config-operator_06_configmap.yaml | 13 +++++++++++++
 .../0000_10_config-operator_07_deployment.yaml      |  9 +++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 manifests/0000_10_config-operator_06_configmap.yaml

diff --git a/manifests/0000_10_config-operator_06_configmap.yaml b/manifests/0000_10_config-operator_06_configmap.yaml
new file mode 100644
index 000000000..6ee64c24a
--- /dev/null
+++ b/manifests/0000_10_config-operator_06_configmap.yaml
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: openshift-config-operator
+  name: openshift-config-operator-config
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+    include.release.openshift.io/single-node-developer: "true"
+    config.openshift.io/inject-tls: "true"
+data:
+  config.yaml: |
+    apiVersion: operator.openshift.io/v1alpha1
+    kind: GenericOperatorConfig
diff --git a/manifests/0000_10_config-operator_07_deployment.yaml b/manifests/0000_10_config-operator_07_deployment.yaml
index beff6ef80..6679644a3 100644
--- a/manifests/0000_10_config-operator_07_deployment.yaml
+++ b/manifests/0000_10_config-operator_07_deployment.yaml
@@ -40,6 +40,9 @@ spec:
       - name: available-featuregates
         emptyDir:
           sizeLimit: 100Mi
+      - name: config
+        configMap:
+          name: openshift-config-operator-config
       initContainers:
         - name: openshift-api
           securityContext:
@@ -75,6 +78,10 @@ spec:
         command:
           - cluster-config-operator
           - operator
+          - --config=/var/run/configmaps/config/config.yaml
+          - --terminate-on-files=/var/run/configmaps/config/config.yaml
+          - --terminate-on-files=/var/run/secrets/serving-cert/tls.crt
+          - --terminate-on-files=/var/run/secrets/serving-cert/tls.key
           - --operator-version=$(OPERATOR_IMAGE_VERSION)
           - --authoritative-feature-gate-dir=/available-featuregates
         ports:
@@ -104,6 +111,8 @@ spec:
           name: serving-cert
         - mountPath: /available-featuregates
           name: available-featuregates
+        - mountPath: /var/run/configmaps/config
+          name: config
         env:
         - name: IMAGE
           value: quay.io/openshift/origin-cluster-config-operator:v4.0