From 646c26a954beed8a8dd5894813405310677438df Mon Sep 17 00:00:00 2001
From: Patrick Dillon <padillon@redhat.com>
Date: Mon, 6 Jul 2026 13:49:52 -0400
Subject: [PATCH] GCP: Update Required Permissions

Updates the credentialsrequests to include the minimal permissions
required to provision a cluster in GCP. With the current implementation
OpenShift does not use the mounted crdentials, provisioned from
the credentials request. Instead it authenticates using the service
account attached to the VM. When the mounted credentials are actually
used, the cloud provider will fail due to the missing permissions
which are added in this commit.
---
 ...ler-manager-operator_16_credentialsrequest-gcp.yaml | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
index 2137688f4..56fe1549b 100644
--- a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
+++ b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
@@ -18,9 +18,12 @@ spec:
     kind: GCPProviderSpec
     permissions:
     - "compute.addresses.create"
+    - "compute.addresses.createInternal"
     - "compute.addresses.delete"
+    - "compute.addresses.deleteInternal"
     - "compute.addresses.get"
     - "compute.addresses.list"
+    - "compute.addresses.useInternal"
     - "compute.firewalls.create"
     - "compute.firewalls.delete"
     - "compute.firewalls.get"
@@ -32,6 +35,7 @@ spec:
     - "compute.healthChecks.delete"
     - "compute.healthChecks.get"
     - "compute.healthChecks.update"
+    - "compute.healthChecks.useReadOnly"
     - "compute.httpHealthChecks.create"
     - "compute.httpHealthChecks.delete"
     - "compute.httpHealthChecks.get"
@@ -39,13 +43,19 @@ spec:
     - "compute.instanceGroups.create"
     - "compute.instanceGroups.delete"
     - "compute.instanceGroups.get"
+    - "compute.instanceGroups.list"
     - "compute.instanceGroups.update"
+    - "compute.instanceGroups.use"
     - "compute.instances.get"
+    - "compute.instances.list"
     - "compute.instances.use"
+    - "compute.networks.updatePolicy"
     - "compute.regionBackendServices.create"
     - "compute.regionBackendServices.delete"
     - "compute.regionBackendServices.get"
     - "compute.regionBackendServices.update"
+    - "compute.regionBackendServices.use"
+    - "compute.subnetworks.use"
     - "compute.targetPools.addInstance"
     - "compute.targetPools.create"
     - "compute.targetPools.delete"