CORS-4508: Add GCD manual OIDC workload identity CI job

ci-operator/config/openshift/installer/openshift-installer-main.yaml

@@ -554,6 +554,24 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       PUBLISH: Internal
     workflow: openshift-e2e-gcd
+- always_run: false
+  as: e2e-gcd-ovn-private-manual-oidc-techpreview
+  optional: true
+  steps:
+    cluster_profile: gcd
+    env:
+      BASE_DOMAIN: ci.gcd.devcluster.openshift.com
+      BASTION_IMAGE_NAME: fedora-coreos-41-20241122-3-0-gcp-x86-64
+      BASTION_IMAGE_PROJECT: eu0:openshift
+      BASTION_MACHINE_TYPE: c3-standard-4
+      COMPUTE_NODE_REPLICAS: "2"
+      COMPUTE_NODE_TYPE: c3-standard-4
+      CONTROL_PLANE_DISK_TYPE: hyperdisk-balanced
+      CONTROL_PLANE_NODE_TYPE: c3-standard-8
+      DEFAULT_MACHINE_OSIMAGE: projects/eu0:openshift/images/rhcos10
+      FEATURE_SET: TechPreviewNoUpgrade
+      PUBLISH: Internal
+    workflow: openshift-e2e-gcd-manual-oidc-workload-identity
 - always_run: false
   as: e2e-gcp-ovn
   pipeline_run_if_changed: (gcp|google)

ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml

@@ -5648,6 +5648,95 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-external-aws-ccm,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build02
+    context: ci/prow/e2e-gcd-ovn-private-manual-oidc-techpreview
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - images/baremetal/Dockerfile.ci
+      - images/installer/Dockerfile.ci
+      - images/installer/Dockerfile.upi.ci
+      - images/libvirt/Dockerfile.ci
+      - images/openstack/Dockerfile.ci
+    labels:
+      ci-operator.openshift.io/cloud: gcp
+      ci-operator.openshift.io/cloud-cluster-profile: gcd
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-installer-main-e2e-gcd-ovn-private-manual-oidc-techpreview
+    optional: true
+    rerun_command: /test e2e-gcd-ovn-private-manual-oidc-techpreview
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-gcd-ovn-private-manual-oidc-techpreview
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-gcd-ovn-private-manual-oidc-techpreview,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:

ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/OWNERS

@@ -0,0 +1,5 @@
+approvers:
+- barbacbd
+- patrickdillon
+- rochacbruno
+- tthvo

ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml",
+	"owners": {
+		"approvers": [
+			"barbacbd",
+			"patrickdillon",
+			"rochacbruno",
+			"tthvo"
+		]
+	}
+}

ci-operator/step-registry/ipi/gcd/pre/manual-oidc-workload-identity/ipi-gcd-pre-manual-oidc-workload-identity-chain.yaml

@@ -0,0 +1,15 @@
+chain:
+  as: ipi-gcd-pre-manual-oidc-workload-identity
+  steps:
+  - ref: gcp-provision-vpc
+  - ref: ignition-bastionhost
+  - ref: gcp-provision-bastionhost
+  - ref: proxy-config-generate
+  - chain: ipi-conf-gcd
+  - ref: ipi-conf-manual-creds
+  - ref: ipi-conf-gcp-oidc-creds-provision
+  - chain: ipi-install
+  documentation: |-
+    The IPI GCD setup chain provisions a VPC, bastion host, and proxy,
+    then installs a private OpenShift cluster on Google Cloud Dedicated
+    with manual OIDC workload identity credentials provisioned by ccoctl.

ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/OWNERS

@@ -0,0 +1,5 @@
+approvers:
+- barbacbd
+- patrickdillon
+- rochacbruno
+- tthvo

ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.metadata.json

@@ -0,0 +1,11 @@
+{
+	"path": "openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml",
+	"owners": {
+		"approvers": [
+			"barbacbd",
+			"patrickdillon",
+			"rochacbruno",
+			"tthvo"
+		]
+	}
+}

ci-operator/step-registry/openshift/e2e/gcd/manual-oidc-workload-identity/openshift-e2e-gcd-manual-oidc-workload-identity-workflow.yaml

@@ -0,0 +1,21 @@
+workflow:
+  as: openshift-e2e-gcd-manual-oidc-workload-identity
+  steps:
+    allow_best_effort_post_steps: true
+    env:
+      TEST_SKIPS: >-
+        CSRs from machines that are not recognized by the cloud provider are not approved
+    pre:
+    - chain: ipi-gcd-pre-manual-oidc-workload-identity
+    test:
+    - ref: openshift-e2e-test
+    post:
+    - chain: gather-core-dump
+    - chain: ipi-gcp-post
+    - ref: ipi-conf-gcp-oidc-creds-deprovision
+    - ref: gcp-deprovision-bastionhost
+    - ref: gcp-deprovision-vpc
+  documentation: |-
+    The OpenShift E2E GCD manual OIDC workflow executes the common
+    end-to-end test suite on a private cluster on Google Cloud Dedicated
+    with manual OIDC workload identity credentials provisioned by ccoctl.