From c9225c744fab2358cfcbf2a30ac94ff954a91b31 Mon Sep 17 00:00:00 2001 From: Bruno Cesar Rocha Date: Thu, 23 Jul 2026 14:22:05 +0100 Subject: [PATCH] CORS-4508: Add e2e-gcd installer CI job for Google Cloud Dedicated Add step-registry components and CI job for testing OpenShift installations on Google Cloud Dedicated using Workload Identity Federation. New step-registry components: - ipi-conf-gcd-wif-auth ref: sets up WIF auth via AWS identity chain - ipi-conf-gcd chain: GCP config with WIF auth step - ipi-gcd-pre chain: full GCD pre-install chain - openshift-e2e-gcd workflow: end-to-end test workflow for GCD The auth flow uses AWS identity chaining: ci-ops injects an AWS config file, the step uses the hub profile (trusted by GCD WIF pool), and the WIF credential config stored as gce.json in the cluster profile secret enables the Google SDK to exchange AWS credentials for GCD tokens. Co-Authored-By: Claude Opus 4.6 (1M context) --- .../installer/openshift-installer-main.yaml | 18 ++++ .../openshift-installer-main-presubmits.yaml | 89 +++++++++++++++++++ .../pre/manual-oidc-workload-identity/OWNERS | 5 ++ ...oidc-workload-identity-chain.metadata.json | 11 +++ ...e-manual-oidc-workload-identity-chain.yaml | 15 ++++ .../gcd/manual-oidc-workload-identity/OWNERS | 5 ++ ...c-workload-identity-workflow.metadata.json | 11 +++ ...anual-oidc-workload-identity-workflow.yaml | 21 +++++ 8 files changed, 175 insertions(+) create mode 100644 ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS create mode 100644 ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json create mode 100644 ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml create mode 100644 ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS create mode 100644 ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json create mode 100644 ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml diff --git a/ci-operator/config/openshift/installer/openshift-installer-main.yaml b/ci-operator/config/openshift/installer/openshift-installer-main.yaml index 193fc94588535..8507b676f33a4 100644 --- a/ci-operator/config/openshift/installer/openshift-installer-main.yaml +++ b/ci-operator/config/openshift/installer/openshift-installer-main.yaml @@ -554,6 +554,24 @@ tests: FEATURE_SET: TechPreviewNoUpgrade PUBLISH: Internal workflow: openshift-e2e-gcd +- always_run: false + as: e2e-gcd-ovn-private-manual-oidc-techpreview + optional: true + steps: + cluster_profile: gcd + env: + BASE_DOMAIN: ci.gcd.devcluster.openshift.com + BASTION_IMAGE_NAME: fedora-coreos-41-20241122-3-0-gcp-x86-64 + BASTION_IMAGE_PROJECT: eu0:openshift + BASTION_MACHINE_TYPE: c3-standard-4 + COMPUTE_NODE_REPLICAS: "2" + COMPUTE_NODE_TYPE: c3-standard-4 + CONTROL_PLANE_DISK_TYPE: hyperdisk-balanced + CONTROL_PLANE_NODE_TYPE: c3-standard-8 + DEFAULT_MACHINE_OSIMAGE: projects/eu0:openshift/images/rhcos10 + FEATURE_SET: TechPreviewNoUpgrade + PUBLISH: Internal + workflow: openshift-e2e-gcd-manual-oidc-workload-identity - always_run: false as: e2e-gcp-ovn pipeline_run_if_changed: (gcp|google) diff --git a/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml b/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml index 509852fd2ec50..cd6d11e7143d1 100644 --- a/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml @@ -5648,6 +5648,95 @@ presubmits: secret: secretName: result-aggregator trigger: (?m)^/test( | .* )e2e-external-aws-ccm,?($|\s.*) + - agent: kubernetes + always_run: false + branches: + - ^main$ + - ^main- + cluster: build02 + context: ci/prow/e2e-gcd-ovn-private-manual-oidc-techpreview + decorate: true + decoration_config: + sparse_checkout_files: + - .ci-operator.yaml + - images/baremetal/Dockerfile.ci + - images/installer/Dockerfile.ci + - images/installer/Dockerfile.upi.ci + - images/libvirt/Dockerfile.ci + - images/openstack/Dockerfile.ci + labels: + ci-operator.openshift.io/cloud: gcp + ci-operator.openshift.io/cloud-cluster-profile: gcd + ci.openshift.io/generator: prowgen + pj-rehearse.openshift.io/can-be-rehearsed: "true" + name: pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview + optional: true + rerun_command: /test e2e-gcd-ovn-private-manual-oidc-techpreview + spec: + containers: + - args: + - --gcs-upload-secret=/secrets/gcs/service-account.json + - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson + - --lease-server-credentials-file=/etc/boskos/credentials + - --report-credentials-file=/etc/report/credentials + - --secret-dir=/secrets/ci-pull-credentials + - --target=e2e-gcd-ovn-private-manual-oidc-techpreview + command: + - ci-operator + env: + - name: HTTP_SERVER_IP + valueFrom: + fieldRef: + fieldPath: status.podIP + image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest + imagePullPolicy: Always + name: "" + ports: + - containerPort: 8080 + name: http + resources: + requests: + cpu: 10m + volumeMounts: + - mountPath: /etc/boskos + name: boskos + readOnly: true + - mountPath: /secrets/ci-pull-credentials + name: ci-pull-credentials + readOnly: true + - mountPath: /secrets/gcs + name: gcs-credentials + readOnly: true + - mountPath: /secrets/manifest-tool + name: manifest-tool-local-pusher + readOnly: true + - mountPath: /etc/pull-secret + name: pull-secret + readOnly: true + - mountPath: /etc/report + name: result-aggregator + readOnly: true + serviceAccountName: ci-operator + volumes: + - name: boskos + secret: + items: + - key: credentials + path: credentials + secretName: boskos-credentials + - name: ci-pull-credentials + secret: + secretName: ci-pull-credentials + - name: manifest-tool-local-pusher + secret: + secretName: manifest-tool-local-pusher + - name: pull-secret + secret: + secretName: registry-pull-credentials + - name: result-aggregator + secret: + secretName: result-aggregator + trigger: (?m)^/test( | .* )e2e-gcd-ovn-private-manual-oidc-techpreview,?($|\s.*) - agent: kubernetes always_run: false branches: diff --git a/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS new file mode 100644 index 0000000000000..d93971ab2936d --- /dev/null +++ b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS @@ -0,0 +1,5 @@ +approvers: +- barbacbd +- patrickdillon +- rochacbruno +- tthvo diff --git a/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json new file mode 100644 index 0000000000000..87c68a1c39aff --- /dev/null +++ b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json @@ -0,0 +1,11 @@ +{ + "path": "ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml", + "owners": { + "approvers": [ + "barbacbd", + "patrickdillon", + "rochacbruno", + "tthvo" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml new file mode 100644 index 0000000000000..2ab3fa96b90eb --- /dev/null +++ b/ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml @@ -0,0 +1,15 @@ +chain: + as: ipi-gcd-pre-manual-oidc-workload-identity + steps: + - ref: gcp-provision-vpc + - ref: ignition-bastionhost + - ref: gcp-provision-bastionhost + - ref: proxy-config-generate + - chain: ipi-conf-gcd + - ref: ipi-conf-manual-creds + - ref: ipi-conf-gcp-oidc-creds-provision + - chain: ipi-install + documentation: |- + The IPI GCD setup chain provisions a VPC, bastion host, and proxy, + then installs a private OpenShift cluster on Google Cloud Dedicated + with manual OIDC workload identity credentials provisioned by ccoctl. diff --git a/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS new file mode 100644 index 0000000000000..d93971ab2936d --- /dev/null +++ b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS @@ -0,0 +1,5 @@ +approvers: +- barbacbd +- patrickdillon +- rochacbruno +- tthvo diff --git a/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json new file mode 100644 index 0000000000000..047399664d558 --- /dev/null +++ b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json @@ -0,0 +1,11 @@ +{ + "path": "openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml", + "owners": { + "approvers": [ + "barbacbd", + "patrickdillon", + "rochacbruno", + "tthvo" + ] + } +} \ No newline at end of file diff --git a/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml new file mode 100644 index 0000000000000..a8af9c305eecf --- /dev/null +++ b/ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml @@ -0,0 +1,21 @@ +workflow: + as: openshift-e2e-gcd-manual-oidc-workload-identity + steps: + allow_best_effort_post_steps: true + env: + TEST_SKIPS: >- + CSRs from machines that are not recognized by the cloud provider are not approved + pre: + - chain: ipi-gcd-pre-manual-oidc-workload-identity + test: + - ref: openshift-e2e-test + post: + - chain: gather-core-dump + - chain: ipi-gcp-post + - ref: ipi-conf-gcp-oidc-creds-deprovision + - ref: gcp-deprovision-bastionhost + - ref: gcp-deprovision-vpc + documentation: |- + The OpenShift E2E GCD manual OIDC workflow executes the common + end-to-end test suite on a private cluster on Google Cloud Dedicated + with manual OIDC workload identity credentials provisioned by ccoctl.