OCPBUGS-114669: Enable GCP custom universe domain support for CCO - #1083
Conversation
Sets the universe domain when initializing GCP clients in order to support running in environments with non-default universe domains such as Google Cloud Dedicated, GCP's sovereign cloud offering. CCO will always use JSON-based creds, either service account with key or WIF. We must utilize the WithAuthCredentialsJSON function because it will use self-signed JWTs rather than oauth token exchange which fails in GCD. The authentication falls back to WithCredentials, as ccoctl can authenticate via the metadata server (obtaining credentials from the service account attached to a VM). (cherry picked from commit 8155da6)
In some cases, such as Google Dedicated Cloud, service accounts take on a different format. When the project has the format eu0:PROJECT_ID, the service account has the format: serviceAccount:SERVICE_ACCOUNT_NAME@PROJECT_ID.eu0.iam.gserviceaccount.com This commit adds some simnple handling for this case. (cherry picked from commit c284a20)
Updates from CredentialsFromJSON -> CredentialsFromJSONWithType to avoid using the deprecated function. This change is a no-op, only intended to avoid deprecation warnings. The new function takes a credential type parameter, which can be used to limit accepted credentials types, which is useful for validating credentials provided by external third parties. For OpenShift, cluster credentials are coming from first party users running clusters in their project, so we do not need to limit which credentials are accepted; therefore we just pass the type through from the credential to the function. (cherry picked from commit aeb83ab)
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
/jira cherrypick OCPBUGS-112145 |
|
@rochacbruno: Jira Issue OCPBUGS-112145 has been cloned as Jira Issue OCPBUGS-114669. Will retitle bug to link to clone. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@rochacbruno: This pull request references Jira Issue OCPBUGS-114669, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
|
@rochacbruno: This pull request references Jira Issue OCPBUGS-114669, which is valid. The bug has been moved to the POST state. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## release-4.22 #1083 +/- ##
================================================
- Coverage 46.88% 46.80% -0.09%
================================================
Files 98 98
Lines 12558 12594 +36
================================================
+ Hits 5888 5894 +6
- Misses 6015 6045 +30
Partials 655 655
🚀 New features to boost your workflow:
|
|
/test security verify-deps |
| @@ -1,4 +1,4 @@ | |||
| FROM golang:1.21 AS builder | |||
| FROM golang:1.26 AS builder | |||
There was a problem hiding this comment.
| FROM golang:1.26 AS builder | |
| FROM golang:1.25 AS builder |
I wonder if we can use go v1.25 instead here since 4.22 release is built with go v1.25? My guess is "yes" based on: https://github.com/googleapis/google-api-go-client/blob/182ae992632d7ba19b5d3c60c71bda28fbfabca1/go.mod#L3
There was a problem hiding this comment.
Good catch, applied. Switched Dockerfile.local to golang:1.25 since release-4.22 is a Go 1.25 release (the go.mod go directive is 1.25.0, and google.golang.org/api v0.258.0 only requires Go 1.25). The golang:1.26 came from the #1068 cherry-pick, which targets master/5.0.
There was a problem hiding this comment.
@tthvo I will have to bump to a new golang api version, 0.258.0 has a bug that was fixed on 0.288
There was a problem hiding this comment.
Ah, right, thanks for checking that 🙏 The version v0.258.0 was indeed retracted (see here) due to that bug you described below :D
|
On the failing
Addressing these belongs in a separate, repo-wide dependency bump rather than this targeted backport. |
|
/jira refresh |
|
@rochacbruno: This pull request references Jira Issue OCPBUGS-114669, which is valid. 7 validation(s) were run on this bug
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Scheduling tests matching the |
|
/payload-job periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade |
|
@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/84b214b0-a561-11f1-9215-1a8b4a28958c-0 |
Fixes the e2e-gcp-manual-oidc failure "dialing: multiple credential options provided" seen when ccoctl builds a GCP client from credentials loaded via the gcloud CLI default path. In v0.258.0, DialSettings.Validate() counted both AuthCredentials and AuthCredentialsJSON toward the credential-option total. When option.WithAuthCredentialsJSON is auto-converted to an auth.Credentials for the new-auth gRPC/storage clients, both were set and validation rejected the dial as having multiple credential options. v0.288.0 no longer counts AuthCredentials in that total, treating it as a special case for oauth2 -> cloud.google.com/go/auth conversion. This matches the google.golang.org/api version already on master, where the identical NewClient code passes e2e-gcp-manual-oidc. k8s.io/api stays pinned at v0.35.2 and github.com/openshift/api is unchanged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
cdf09a9 to
5c5bdc1
Compare
|
The Root cause is the
I bumped |
tthvo
left a comment
There was a problem hiding this comment.
/lgtm
+1 for the failure analysis #1083 (comment) 🚀. This exact issue was filed and addressed in googleapis/google-cloud-go#13503.
|
Scheduling tests matching the |
|
/payload-job periodic-ci-openshift-release-main-ci-4.22-upgrade-from-stable-4.21-e2e-gcp-ovn-upgrade |
|
@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/0d89b560-a588-11f1-9064-e2968598da27-0 |
|
The The suite went red on two blocking failures that are unrelated to this backport and to CCO:
Both are generic Kubernetes/OpenShift platform conformance tests. The only CCO-related failure ( Re-running the job to clear the flakes. /test e2e-gcp-manual-oidc |
|
/approve |
|
@patrickdillon: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/cc @jstuever |
|
/approve |
|
/label backport-risk-assessed |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dlom, patrickdillon, rochacbruno, tthvo The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/override ci/prow/security |
|
@patrickdillon: patrickdillon unauthorized: /override is restricted to Repo administrators, approvers in top level OWNERS file, and the following github teams:openshift: openshift-ci-job-overriders openshift-release-oversight openshift-staff-engineers openshift-sustaining-engineers. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/override ci/prow/security |
|
@dlom: Overrode contexts on behalf of dlom: ci/prow/security DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@rochacbruno: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
26005d2
into
openshift:release-4.22
|
@rochacbruno: Jira Issue Verification Checks: Jira Issue OCPBUGS-114669 Jira Issue OCPBUGS-114669 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
Backport of #1068 to release-4.22.
Cherry-picks the GCP client and service-account changes that add support for custom (alternate) universe domains:
CredentialsFromJSONusageIt also bumps
google.golang.org/apiv0.252.0 -> v0.258.0, the minimal version providingoption.WithAuthCredentialsJSONandoption.CredentialsTypeused by the cherry-picked code.k8s.io/apistays at v0.35.2 andgithub.com/openshift/apiis unchanged.Note: the companion ccoctl change (#1073) is intentionally NOT included here. It depends on the
GCPPlatformStatus.UniverseDomainfield from openshift/api #2963 (CORS-4417), which has not yet been backported to openshift/api release-4.22.