Skip to content

CORS-4549: gcp: set universe domain in Infrastructure status for GCD - #10759

Open
patrickdillon wants to merge 3 commits into
openshift:mainfrom
patrickdillon:gcd-universe-domain
Open

CORS-4549: gcp: set universe domain in Infrastructure status for GCD#10759
patrickdillon wants to merge 3 commits into
openshift:mainfrom
patrickdillon:gcd-universe-domain

Conversation

@patrickdillon

@patrickdillon patrickdillon commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

Populate GCPPlatformStatus.UniverseDomain in the Infrastructure manifest when the GCPSovereignCloudInstall feature gate is enabled and the credential's universe domain is non-default. This allows downstream operators to read the universe domain from the Infrastructure CR.

When the feature gate is not enabled, the block is skipped entirely so there is no change in behavior for standard GCP installs.

Summary by CodeRabbit

  • New Features
    • Added support for sovereign-cloud GCP installations.
    • GCP infrastructure generation now detects custom universe domains and records non-default domains in infrastructure status.
    • Installation configuration and feature-gate support now enable the required sovereign-cloud settings.
  • Bug Fixes
    • Improved error handling when GCP session or universe-domain information cannot be retrieved during infrastructure generation.

Populate GCPPlatformStatus.UniverseDomain in the Infrastructure
manifest when the GCPSovereignCloudInstall feature gate is enabled
and the credential's universe domain is non-default. This allows
downstream operators to read the universe domain from the
Infrastructure CR.

When the feature gate is not enabled, the block is skipped entirely
so there is no change in behavior for standard GCP installs.
@coderabbitai

coderabbitai Bot commented Aug 11, 2026

Copy link
Copy Markdown

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: abfba719-f3a7-4436-a0ec-febf7c0d3d6d

📥 Commits

Reviewing files that changed from the base of the PR and between 40a5f63 and 8d5f78d.

⛔ Files ignored due to path filters (7)
  • go.sum is excluded by !**/*.sum
  • vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !vendor/**, !**/vendor/**
  • vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
  • vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
  • vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
  • vendor/github.com/openshift/api/features/features.go is excluded by !vendor/**, !**/vendor/**
  • vendor/modules.txt is excluded by !vendor/**, !**/vendor/**
📒 Files selected for processing (1)
  • go.mod

📝 Walkthrough

Walkthrough

GCP infrastructure generation now uses sovereign-cloud feature gating to obtain the GCP session and universe domain. It records non-default domains in infrastructure status and returns errors when either lookup fails.

Changes

GCP sovereign-cloud infrastructure

Layer / File(s) Summary
Resolve and store the GCP universe domain
pkg/asset/manifests/infrastructure.go, go.mod
When sovereign-cloud support is enabled, the generator retrieves the GCP session and universe domain. It records non-default domains and returns wrapped lookup errors. The github.com/openshift/api dependency is updated to the required revision.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 15
✅ Passed checks (15 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly describes the main change: setting the GCP universe domain in Infrastructure status for GCD.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The PR adds no Ginkgo tests. Changed table-driven t.Run cases use static descriptive name literals, with no generated IDs, timestamps, node names, namespaces, IPs, or other run-dependent values.
Test Structure And Quality ✅ Passed The PR changes no *_test.go files, and infrastructure_test.go uses Go testing/testify rather than Ginkgo; no changed Ginkgo test code triggers these quality requirements.
Microshift Test Compatibility ✅ Passed The pull request adds no Ginkgo tests or test-like files. Its diff contains only infrastructure logic and dependency/vendor updates, so the MicroShift test check does not apply.
Single Node Openshift (Sno) Test Compatibility ✅ Passed The pull request adds no Ginkgo tests or test files; its diff only changes infrastructure generation and dependencies, so SNO multi-node compatibility is not applicable.
Topology-Aware Scheduling Compatibility ✅ Passed The diff only adds GCP universe-domain status generation and dependency/API metadata; it adds no replicas, affinities, topology spreads, selectors, tolerations, or PDBs.
Ote Binary Stdout Contract ✅ Passed The PR adds no stdout writes or suite/entrypoint setup. It only calls existing GCP session logic, while installer logging routes to discard and stderr; changed vendor files add no output.
Ipv6 And Disconnected Network Test Compatibility ✅ Passed The base-to-HEAD diff adds no Ginkgo tests or test files; it changes infrastructure generation, dependency metadata, and vendored API code only.
No-Weak-Crypto ✅ Passed The PR adds session and universe-domain lookup only; the complete diff contains no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret/token comparison.
Container-Privileges ✅ Passed The PR changes Go logic, module metadata, and vendored API only; the diff adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, or allowPrivilegeEscalation settings.
No-Sensitive-Data-In-Logs ✅ Passed The PR adds no logging calls. It only wraps credential/session errors and writes a non-default GCP universe domain to Infrastructure status; no password, token, key, PII, or customer data enters logs.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions


Comment @coderabbitai help to get the list of available commands.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 11, 2026
@openshift-ci-robot

openshift-ci-robot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

@patrickdillon: This pull request references CORS-4549 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Populate GCPPlatformStatus.UniverseDomain in the Infrastructure manifest when the GCPSovereignCloudInstall feature gate is enabled and the credential's universe domain is non-default. This allows downstream operators to read the universe domain from the Infrastructure CR.

When the feature gate is not enabled, the block is skipped entirely so there is no change in behavior for standard GCP installs.

Summary by CodeRabbit

  • New Features
  • Added support for sovereign-cloud GCP installations.
  • GCP infrastructure generation now detects custom universe domains and records them in infrastructure status.
  • Bug Fixes
  • Improved error handling when GCP session or universe-domain information cannot be retrieved.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci-robot

openshift-ci-robot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

@patrickdillon: This pull request references CORS-4549 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Populate GCPPlatformStatus.UniverseDomain in the Infrastructure manifest when the GCPSovereignCloudInstall feature gate is enabled and the credential's universe domain is non-default. This allows downstream operators to read the universe domain from the Infrastructure CR.

When the feature gate is not enabled, the block is skipped entirely so there is no change in behavior for standard GCP installs.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci
openshift-ci Bot requested review from andfasano and tthvo August 11, 2026 15:01

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
pkg/asset/manifests/infrastructure.go (1)

227-227: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Add unit coverage for the GCP sovereign-cloud path

types.InstallConfig.Enabled(...) is valid. Keep the current feature-gate call. Add tests for universe-domain propagation and session errors.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/asset/manifests/infrastructure.go` at line 227, Add unit tests for the
GCP sovereign-cloud branch guarded by
installConfig.Config.Enabled(features.FeatureGateGCPSovereignCloudInstall),
covering universe-domain propagation and session-error handling. Preserve the
existing feature-gate call and use types.InstallConfig.Enabled(...) in the test
setup.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@pkg/asset/manifests/infrastructure.go`:
- Around line 227-239: Add deterministic tests in infrastructure_test.go for the
GCPSovereignCloudInstall logic in the infrastructure manifest flow, using mocked
or injected GCP session behavior rather than ambient credentials. Cover a
disabled feature gate, default and non-default universe domains, GetSession
errors, and GetUniverseDomain errors; verify non-default domains update
config.Status.PlatformStatus.GCP.UniverseDomain and all error paths return the
expected wrapped errors.

---

Nitpick comments:
In `@pkg/asset/manifests/infrastructure.go`:
- Line 227: Add unit tests for the GCP sovereign-cloud branch guarded by
installConfig.Config.Enabled(features.FeatureGateGCPSovereignCloudInstall),
covering universe-domain propagation and session-error handling. Preserve the
existing feature-gate call and use types.InstallConfig.Enabled(...) in the test
setup.
🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: dc7d6e05-23e2-46c5-85c0-782d65224a80

📥 Commits

Reviewing files that changed from the base of the PR and between 3a117ed and 40a5f63.

📒 Files selected for processing (1)
  • pkg/asset/manifests/infrastructure.go

Comment thread pkg/asset/manifests/infrastructure.go

@tthvo tthvo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn

@openshift-ci

openshift-ci Bot commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tthvo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Aug 11, 2026
@tthvo

tthvo commented Aug 11, 2026

Copy link
Copy Markdown
Member

/test e2e-gcd-ovn-private-techpreview
/test e2e-gcp-ovn
/test e2e-gcp-ovn-techpreview

@patrickdillon

Copy link
Copy Markdown
Contributor Author

Thanks for taking a look.

Heads up:

/test e2e-gcd-ovn-private-techpreview

Will not actually verify this, because the gate was in dev preview.

openshift/api#2970 just merged, so I will pull it into this pr and then we can use that e2e to verify.

@tthvo

tthvo commented Aug 11, 2026

Copy link
Copy Markdown
Member

Will not actually verify this, because the gate was in dev preview.

Ah whoops, thanks! I kept forgetting that lol

@tthvo

tthvo commented Aug 11, 2026

Copy link
Copy Markdown
Member

Will not actually verify this, because the gate was in dev preview.

Ah whoops, thanks! I kept forgetting that lol

Hmm, that got me wonder if we should add any validation to allow GCD install only when the feature gate is enabled (like AWS EUSC). Right now, the gcd e2e can install just fine because there's none 🤔

Pull in GCD at TechPreview.
go mod vendor
@openshift-ci openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2026
@patrickdillon

Copy link
Copy Markdown
Contributor Author

now includes api bump

/test e2e-gcd-ovn-private-techpreview

@tthvo

tthvo commented Aug 11, 2026

Copy link
Copy Markdown
Member

/test e2e-gcp-ovn
/test e2e-gcp-ovn-techpreview

Expecting the field shouldn't be set there.

@tthvo tthvo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Aug 11, 2026
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. lgtm Indicates that a PR is ready to be merged.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants