enhancements#922 and OCPPLAN-7589 propose a new system of cluster capabilities that the cluster administrators can opt into at install time or with later, day-2 ClusterVersion spec changes. These optional capabilities may include CredentialsRequests manifests. That puts them in a similar situation as the TechPreviewNoUpgrade feature gate, where ccoctl is currently learning to ignore gated cred requests. It would be possible for ccoctl to follow that pattern for capabilities, and require cluster admins to manually fiddle with annotations if they want credentials for newly-enabled components, but instead we will teach oc adm release extract new flags to try to perform the manifest filtering at extract time (OTA-559). oc ad release extract will need to look up cluster-config knobs (cluster profile, feature gates, capabilities, etc.). Once there's a cluster, it can do that via a kubeconfig. Pre-install, we'll use --install-config to give the extraction code some context about the cluster being installed (including the planned capability configuration).

Post-install, OTA-559 should handle the dev work. But that's outside of this epic, which will track docs and QE as the recommended ccoctl flows get updated to keep up with the oc adm release extract changes.