CORS-4508: Add GCD manual OIDC workload identity CI job by rochacbruno · Pull Request #82348 · openshift/release

rochacbruno · 2026-07-23T13:22:48Z

Summary

Add CI job e2e-gcd-ovn-private-manual-oidc-techpreview for testing OpenShift installations on Google Cloud Dedicated with manual OIDC workload identity credentials provisioned by ccoctl.

New step-registry components

ipi-gcd-pre-manual-oidc-workload-identity chain: GCD private cluster setup with manual OIDC credential provisioning via ccoctl
openshift-e2e-gcd-manual-oidc-workload-identity workflow: end-to-end test workflow with OIDC creds provision/deprovision

Job configuration

always_run: false, optional: true
cluster_profile: gcd
Same GCD env vars as e2e-gcd-ovn-private-techpreview (C3 machines, hyperdisk-balanced, private DNS, rhcos10 image)
Uses ipi-conf-manual-creds + ipi-conf-gcp-oidc-creds-provision for WIF setup
TEST_SKIPS for CSR test (same as GCP manual OIDC job)

How it works

The workflow combines the GCD private cluster infrastructure (VPC, bastion, proxy) with the manual OIDC credential provisioning steps:

Provision VPC, bastion, proxy (same as e2e-gcd-ovn-private-techpreview)
Configure install-config with GCD settings
Set credentialsMode: Manual
Run ccoctl gcp create-all to provision WIF pool, provider, and per-operator service accounts
Install cluster
Run e2e tests
Deprovision: cluster, OIDC resources, bastion, VPC

Dependencies

CORS-4524: Enable GCP custom universe domain support for CCO cloud-credential-operator#1068 - enables ccoctl universe domain support for GCD (required for ipi-conf-gcp-oidc-creds-provision step)
CORS-4420, CORS-4421, CORS-4422, CORS-4449, CORS-4514, CORS-4425: Add Google Cloud Dedicated support installer#10630 - GCD installer support (required for install step)

Test plan

CI checks pass on this PR
CCO PR CORS-4524: Enable GCP custom universe domain support for CCO cloud-credential-operator#1068 merges (ccoctl GCD support)
Installer PR CORS-4420, CORS-4421, CORS-4422, CORS-4449, CORS-4514, CORS-4425: Add Google Cloud Dedicated support installer#10630 merges (installer GCD support)
/pj-rehearse pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview passes

Generated with Claude Code

Summary by CodeRabbit

Adds optional CI coverage for private OpenShift installations on Google Cloud Dedicated using manually provisioned OIDC workload identity credentials via ccoctl.

Introduces the GCD manual OIDC pre-installation chain and end-to-end workflow.
Configures VPC, bastion, proxy, private-cluster, manual-credentials, OIDC provisioning, testing, and cleanup steps.
Adds the e2e-gcd-ovn-private-manual-oidc-techpreview TechPreview job using the gcd cluster profile.
Includes a CSR test skip consistent with existing GCP manual OIDC coverage.

Add step-registry components and CI job for testing OpenShift installations on Google Cloud Dedicated using Workload Identity Federation. New step-registry components: - ipi-conf-gcd-wif-auth ref: sets up WIF auth via AWS identity chain - ipi-conf-gcd chain: GCP config with WIF auth step - ipi-gcd-pre chain: full GCD pre-install chain - openshift-e2e-gcd workflow: end-to-end test workflow for GCD The auth flow uses AWS identity chaining: ci-ops injects an AWS config file, the step uses the hub profile (trusted by GCD WIF pool), and the WIF credential config stored as gce.json in the cluster profile secret enables the Google SDK to exchange AWS credentials for GCD tokens. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci-robot · 2026-07-23T13:22:53Z

@rochacbruno: This pull request references CORS-4508 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Add CI job e2e-gcd-ovn-private-manual-oidc-techpreview for testing OpenShift installations on Google Cloud Dedicated with manual OIDC workload identity credentials provisioned by ccoctl.

New step-registry components

ipi-gcd-pre-manual-oidc-workload-identity chain: GCD private cluster setup with manual OIDC credential provisioning via ccoctl

openshift-e2e-gcd-manual-oidc-workload-identity workflow: end-to-end test workflow with OIDC creds provision/deprovision

Job configuration

always_run: false, optional: true

cluster_profile: gcd

Same GCD env vars as e2e-gcd-ovn-private-techpreview (C3 machines, hyperdisk-balanced, private DNS, rhcos10 image)

Uses ipi-conf-manual-creds + ipi-conf-gcp-oidc-creds-provision for WIF setup

TEST_SKIPS for CSR test (same as GCP manual OIDC job)

How it works

The workflow combines the GCD private cluster infrastructure (VPC, bastion, proxy) with the manual OIDC credential provisioning steps:

Provision VPC, bastion, proxy (same as e2e-gcd-ovn-private-techpreview)

Configure install-config with GCD settings

Set credentialsMode: Manual

Run ccoctl gcp create-all to provision WIF pool, provider, and per-operator service accounts

Install cluster

Run e2e tests

Deprovision: cluster, OIDC resources, bastion, VPC

Dependencies

CORS-4524: Enable GCP custom universe domain support for CCO cloud-credential-operator#1068 - enables ccoctl universe domain support for GCD (required for ipi-conf-gcp-oidc-creds-provision step)

CORS-4420, CORS-4421, CORS-4422, CORS-4449, CORS-4514, CORS-4425: Add Google Cloud Dedicated support installer#10630 - GCD installer support (required for install step)

Test plan

CI checks pass on this PR

CCO PR Have the telemeter unit test build everything for now #1068 merges (ccoctl GCD support)

Installer PR Registry-Replacer autoupdate #10630 merges (installer GCD support)

/pj-rehearse pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview passes

Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-07-23T13:23:22Z

Walkthrough

Adds a private GCD end-to-end workflow for manual OIDC workload identity, including infrastructure setup, OpenShift testing, cleanup, ownership metadata, and optional TechPreview installer registration.

Changes

Manual OIDC GCD E2E

Layer / File(s)	Summary
GCD manual OIDC setup chain `ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/*`	Defines ordered VPC, bastion, proxy, credential provisioning, and private GCD installation steps with ownership metadata.
GCD manual OIDC E2E workflow `ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/*`	Adds the pre-test chain, OpenShift E2E execution, CSR skip configuration, best-effort cleanup, and workflow ownership metadata.
Installer test registration `ci-operator/config/openshift/installer/openshift-installer-main.yaml`	Registers the workflow as an optional, non-always-running TechPreview test using the `gcd` cluster profile.

Estimated code review effort: 2 (Simple) | ~10 minutes

Sequence Diagram(s)

sequenceDiagram
  participant InstallerTest
  participant ManualOIDCWorkflow
  participant GCDSetupChain
  participant OpenShiftE2E
  participant Cleanup
  InstallerTest->>ManualOIDCWorkflow: Select optional TechPreview workflow
  ManualOIDCWorkflow->>GCDSetupChain: Provision private GCD cluster and OIDC credentials
  ManualOIDCWorkflow->>OpenShiftE2E: Run end-to-end tests
  OpenShiftE2E-->>ManualOIDCWorkflow: Return test results
  ManualOIDCWorkflow->>Cleanup: Gather diagnostics and deprovision resources

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The PR only adds ci-operator/step-registry YAML and OWNERS metadata; no Ginkgo It/Describe/Context/When titles or dynamic test names were added.
Test Structure And Quality	✅ Passed	PASS: The PR only changes CI/step-registry YAML, OWNERS, and metadata; no Ginkgo test code or It/BeforeEach/Eventually blocks were added or modified.
Microshift Test Compatibility	✅ Passed	No new Ginkgo test code was added; this PR only adds CI/job and step-registry YAML, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The patch adds only CI/job and step-registry YAML; no new Ginkgo It/Describe/Context/When tests were introduced, so the SNO check is N/A.
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The PR only adds CI job/workflow step-registry YAML; I found no pod affinity, topology spread, node selectors, PDBs, or ControlPlaneTopology logic.
Ote Binary Stdout Contract	✅ Passed	PR only changes CI YAML/OWNERS/metadata; no Go or other process-level code was modified, so no stdout contract risk was introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR adds CI/job wiring and step-registry YAML only; no Go/Ginkgo test bodies were introduced, so IPv4/external-connectivity review is not applicable.
No-Weak-Crypto	✅ Passed	Touched files are CI YAML/metadata only; searches found no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB or constant-time comparison code.
Container-Privileges	✅ Passed	Scanned all changed YAML/job files; found no privileged/hostPID/hostNetwork/hostIPC, allowPrivilegeEscalation, SYS_ADMIN, or root securityContext settings.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging code or output of secrets/PII was added; the PR only adds CI config, step chains, and workflow metadata.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main change: adding a GCD manual OIDC workload identity CI job.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-07-23T13:24:11Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rochacbruno

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/config/openshift/installer/OWNERS~~ [rochacbruno]
~~ci-operator/jobs/openshift/installer/OWNERS~~ [rochacbruno]
~~ci-operator/step-registry/ipi/gcd/pre/OWNERS~~ [rochacbruno]
~~ci-operator/step-registry/openshift/e2e/gcd/OWNERS~~ [rochacbruno]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-merge-bot · 2026-07-23T13:25:42Z

[REHEARSALNOTIFIER]
@rochacbruno: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview	openshift/installer	presubmit	Presubmit changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

rochacbruno · 2026-07-23T13:33:34Z

/pj-rehearse pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview

openshift-merge-bot · 2026-07-23T13:33:37Z

@rochacbruno: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

patrickdillon · 2026-07-23T14:54:43Z

+      CONTROL_PLANE_DISK_TYPE: hyperdisk-balanced
+      CONTROL_PLANE_NODE_TYPE: c3-standard-8


nit: these should not be needed after openshift/installer#10706

openshift-ci · 2026-07-23T15:00:03Z

@rochacbruno: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/installer/main/e2e-gcd-ovn-private-manual-oidc-techpreview	`c9225c7`	link	unknown	`/pj-rehearse pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jul 23, 2026

openshift-ci Bot requested review from andfasano and barbacbd July 23, 2026 13:23

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 23, 2026

patrickdillon reviewed Jul 23, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

CORS-4508: Add GCD manual OIDC workload identity CI job#82348

CORS-4508: Add GCD manual OIDC workload identity CI job#82348
rochacbruno wants to merge 1 commit into
openshift:mainfrom
rochacbruno:CORS-4508/add-gcd-manual-oidc-job

rochacbruno commented Jul 23, 2026 •

edited

Loading

Uh oh!

openshift-ci-robot commented Jul 23, 2026 •

edited by atlassian Bot

Loading

Summary

New step-registry components

Job configuration

How it works

Dependencies

Test plan

Uh oh!

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

rochacbruno commented Jul 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

patrickdillon Jul 23, 2026

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		CONTROL_PLANE_DISK_TYPE: hyperdisk-balanced
		CONTROL_PLANE_NODE_TYPE: c3-standard-8

Uh oh!

Conversation

rochacbruno commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New step-registry components

Job configuration

How it works

Dependencies

Test plan

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Jul 23, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

New step-registry components

Job configuration

How it works

Dependencies

Test plan

Uh oh!

coderabbitai Bot commented Jul 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

rochacbruno commented Jul 23, 2026

Uh oh!

openshift-merge-bot Bot commented Jul 23, 2026

Uh oh!

patrickdillon Jul 23, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rochacbruno commented Jul 23, 2026 •

edited

Loading

openshift-ci-robot commented Jul 23, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Jul 23, 2026 •

edited

Loading