Skip to content

OCPBUGS-58062#GCP credential fix #100900

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 18, 2025
Merged

OCPBUGS-58062#GCP credential fix #100900

merged 1 commit into from
Nov 18, 2025

Conversation

@brendan-daly-red-hat
Copy link
Contributor

@brendan-daly-red-hat brendan-daly-red-hat commented Oct 22, 2025 •
edited
Loading

@openshift-ci openshift-ci bot added the size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. label Oct 22, 2025
@ocpdocs-previewbot
Copy link

ocpdocs-previewbot commented Oct 22, 2025 •
edited
Loading

🤖 Tue Nov 18 10:18:22 - Prow CI generated the docs preview:

https://100900--ocpdocs-pr.netlify.app/openshift-enterprise/latest/installing/installing_gcp/installing-gcp-customizations.html
https://100900--ocpdocs-pr.netlify.app/openshift-enterprise/latest/installing/installing_gcp/preparing-to-install-on-gcp.html

@openshift-ci openshift-ci bot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Oct 22, 2025
@brendan-daly-red-hat brendan-daly-red-hat force-pushed the OCPBUGS-58062 branch 2 times, most recently from cc37477 to f80243b Compare October 23, 2025 10:07
@openshift-ci openshift-ci bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/S Denotes a PR that changes 10-29 lines, ignoring generated files. labels Oct 23, 2025
@brendan-daly-red-hat brendan-daly-red-hat force-pushed the OCPBUGS-58062 branch 3 times, most recently from 90d6c33 to b6d239f Compare October 23, 2025 15:15
jstuever
jstuever suggested changes Oct 23, 2025
View reviewed changes
installing/installing_gcp/installing-gcp-customizations.adoc Outdated
=== Configuring a {gcp-short} cluster to use short-term credentials

To install a cluster that is configured to use {gcp-short} Workload Identity, you must configure the CCO utility and create the required {gcp-short} resources for your cluster.
To install a cluster that is configured to use {gcp-short} Workload Identity, you must configure the Cloud Credential Operator (CCO) utility and create the required {gcp-short} resources for your cluster. Cluster Operators use the credential requests created by the CCO. The installation program does not use these credential requests.
Copy link

@jstuever jstuever Oct 23, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Drop the word requests in both uses. A credentialRequest is a custom resource definition that allows the various components to communicate to CCO how to create the resources (i.e., what permissions they require). The output of CCO is a) cluster resources (can summarized as credentials) and b) corresponding manifests that the installer will apply to the cluster.

- To install a cluster that is configured to use {gcp-short} Workload Identity, you must configure the Cloud Credential Operator (CCO) utility and create the required {gcp-short} resources for your cluster. Cluster Operators use the credential requests created by the CCO. The installation program does not use these credential requests.
+ To install a cluster that is configured to use {gcp-short} Workload Identity, you must configure the Cloud Credential Operator (CCO) utility and create the required {gcp-short} resources for your cluster. Cluster Operators use the credentials created by the CCO. The installation program does not use these credentials.

@brendan-daly-red-hat brendan-daly-red-hat force-pushed the OCPBUGS-58062 branch 2 times, most recently from 90e5b7c to 9999867 Compare October 24, 2025 09:57
jianli-wei
jianli-wei suggested changes Oct 28, 2025
View reviewed changes
modules/cco-ccoctl-configuring.adoc Outdated

* You have access to an {product-title} account with cluster administrator access.
* You have authenticated with a service account that uses a {gcp-short} virtual machine (VM) for your cluster installation.
* You have configured your cluster Operators with the CCO to use {gcp-short} Workload Identity.
Copy link

@jianli-wei jianli-wei Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could you please explain why we need the above 2 prerequisites? I'm asking because I don't think they should be included in prerequisites. Thanks!

Copy link
Contributor Author

@brendan-daly-red-hat brendan-daly-red-hat Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jianli-wei, In the 'Description' of https://issues.redhat.com/browse/OCPBUGS-58062, it lists these types credentials as required. Should I remove this text completely or add it to a different part of the documentation?

Copy link

@jianli-wei jianli-wei Oct 29, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's wait for Linh's comments, thanks!

Copy link

@jianli-wei jianli-wei Nov 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@brendan-daly-red-hat Please see Linh's comment in the bug, and I suggest to remove the two statements from the prerequisites. WDYT?

Copy link
Contributor Author

@brendan-daly-red-hat brendan-daly-red-hat Nov 12, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jianli-wei, PTAL at the update to Configuring the Cloud Credential Operator utility based on Linh's comment in the bug. Thanks.

installing/installing_gcp/preparing-to-install-on-gcp.adoc Outdated

If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, see xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#manually-create-iam_installing-gcp-customizations[Manually creating long-term credentials for GCP] for other options.

To install a cluster that is configured to use {gcp-short} Workload Identity, you must configure the Cloud Credential Operator (CCO) utility and create the required {gcp-short} resources for your cluster. For more information, see xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-with-short-term-creds_installing-gcp-customizations[Configuring a {gcp-short} cluster to use short-term credentials].
Copy link

@jianli-wei jianli-wei Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Rather than adding this paragraph, how about updating the last paragraph as below?

If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the kube-system namespace, see Configuring a Google Cloud cluster to use short-term credentials and/or Manually creating long-term credentials for GCP for other options.

Copy link
Contributor Author

@brendan-daly-red-hat brendan-daly-red-hat Oct 28, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applied this change.

@brendan-daly-red-hat brendan-daly-red-hat force-pushed the OCPBUGS-58062 branch 3 times, most recently from 39f9b60 to 32b42c0 Compare October 28, 2025 10:03
@openshift-merge-robot openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 1, 2025
@openshift-merge-robot openshift-merge-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Nov 12, 2025
jianli-wei
jianli-wei suggested changes Nov 18, 2025
View reviewed changes
installing/installing_gcp/preparing-to-install-on-gcp.adoc Outdated
Before installing {product-title} on {gcp-first}, you must create a service account and configure a {gcp-short} project. See xref:../../installing/installing_gcp/installing-gcp-account.adoc#installing-gcp-account[Configuring a {gcp-short} project] for details about creating a project, enabling API services, configuring DNS, {gcp-short} account limits, and supported {gcp-short} regions.

If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, see xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#manually-create-iam_installing-gcp-customizations[Manually creating long-term credentials for {gcp-short}] for other options.
If the cloud identity and access management (IAM) APIs are not accessible in your environment, or if you do not want to store an administrator-level credential secret in the `kube-system` namespace, see xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#installing-gcp-with-short-term-creds_installing-gcp-customizations[Configuring a {gcp-short} cluster to use short-term credentials], xref:../../installing/installing_gcp/installing-gcp-customizations.adoc#manually-create-iam_installing-gcp-customizations[Manually creating long-term credentials for {gcp-short}], or both for other options.
Copy link

@jianli-wei jianli-wei Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggest to replace "identity and access management" with "Identity and Access Management".

Copy link
Contributor Author

@brendan-daly-red-hat brendan-daly-red-hat Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Applied this change.

modules/cco-ccoctl-configuring.adoc Outdated
.Prerequisites

* You have access to an {product-title} account with cluster administrator access.
* You have run the `ccoctl` utility, to ensure your cluster Operators authenticate with {gcp-short} APIs that use Workload Identity.
Copy link

@jianli-wei jianli-wei Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Running "ccoctl" isn't a prerequisites, instead, it is one of the steps, e.g. see the subsequent "3. Use the ccoctl tool to process all CredentialsRequest objects by running the following command".

Copy link
Contributor Author

@brendan-daly-red-hat brendan-daly-red-hat Nov 18, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed this prerequisite.

@brendan-daly-red-hat brendan-daly-red-hat force-pushed the OCPBUGS-58062 branch 2 times, most recently from 528d7c1 to 8df0e88 Compare November 18, 2025 10:03
@openshift-ci
Copy link

openshift-ci bot commented Nov 18, 2025

@brendan-daly-red-hat: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@brendan-daly-red-hat
Copy link
Contributor Author

brendan-daly-red-hat commented Nov 18, 2025

@jianli-wei, PTAL

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 18, 2025
@brendan-daly-red-hat
Copy link
Contributor Author

brendan-daly-red-hat commented Nov 18, 2025

/label merge-review-needed

@openshift-ci openshift-ci bot added the merge-review-needed Signifies that the merge review team needs to review this PR label Nov 18, 2025
@ShaunaDiaz ShaunaDiaz added this to the Continuous Release milestone Nov 18, 2025
ShaunaDiaz
ShaunaDiaz reviewed Nov 18, 2025
View reviewed changes
Copy link
Contributor

@ShaunaDiaz ShaunaDiaz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@ShaunaDiaz ShaunaDiaz merged commit e146725 into openshift:main Nov 18, 2025
2 checks passed
@ShaunaDiaz
Copy link
Contributor

ShaunaDiaz commented Nov 18, 2025

/cherrypick enterprise-4.21

@ShaunaDiaz
Copy link
Contributor

ShaunaDiaz commented Nov 18, 2025

/cherrypick enterprise-4.20

@ShaunaDiaz
Copy link
Contributor

ShaunaDiaz commented Nov 18, 2025

/cherrypick enterprise-4.19

@ShaunaDiaz
Copy link
Contributor

ShaunaDiaz commented Nov 18, 2025

/cherrypick enterprise-4.18

@ShaunaDiaz
Copy link
Contributor

ShaunaDiaz commented Nov 18, 2025

/cherrypick enterprise-4.17

@openshift-cherrypick-robot
Copy link

openshift-cherrypick-robot commented Nov 18, 2025

@ShaunaDiaz: new pull request created: #102673

In response to this:

/cherrypick enterprise-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Nov 18, 2025
Merged
@openshift-cherrypick-robot
Copy link

openshift-cherrypick-robot commented Nov 18, 2025

@ShaunaDiaz: new pull request created: #102674

In response to this:

/cherrypick enterprise-4.20

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot openshift-cherrypick-robot mentioned this pull request Nov 18, 2025
Merged
@openshift-cherrypick-robot
Copy link

openshift-cherrypick-robot commented Nov 18, 2025

@ShaunaDiaz: #100900 failed to apply on top of branch "enterprise-4.19":

Applying: OCPBUGS-58062:GCP credential fix
Using index info to reconstruct a base tree...
M	installing/installing_gcp/installing-gcp-customizations.adoc
M	installing/installing_gcp/preparing-to-install-on-gcp.adoc
Falling back to patching base and 3-way merge...
Auto-merging installing/installing_gcp/preparing-to-install-on-gcp.adoc
Auto-merging installing/installing_gcp/installing-gcp-customizations.adoc
CONFLICT (content): Merge conflict in installing/installing_gcp/installing-gcp-customizations.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 OCPBUGS-58062:GCP credential fix

In response to this:

/cherrypick enterprise-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot
Copy link

openshift-cherrypick-robot commented Nov 18, 2025

@ShaunaDiaz: #100900 failed to apply on top of branch "enterprise-4.18":

Applying: OCPBUGS-58062:GCP credential fix
Using index info to reconstruct a base tree...
M	installing/installing_gcp/installing-gcp-customizations.adoc
M	installing/installing_gcp/preparing-to-install-on-gcp.adoc
Falling back to patching base and 3-way merge...
Auto-merging installing/installing_gcp/preparing-to-install-on-gcp.adoc
Auto-merging installing/installing_gcp/installing-gcp-customizations.adoc
CONFLICT (content): Merge conflict in installing/installing_gcp/installing-gcp-customizations.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 OCPBUGS-58062:GCP credential fix

In response to this:

/cherrypick enterprise-4.18

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@openshift-cherrypick-robot
Copy link

openshift-cherrypick-robot commented Nov 18, 2025

@ShaunaDiaz: #100900 failed to apply on top of branch "enterprise-4.17":

Applying: OCPBUGS-58062:GCP credential fix
Using index info to reconstruct a base tree...
M	installing/installing_gcp/installing-gcp-customizations.adoc
M	installing/installing_gcp/preparing-to-install-on-gcp.adoc
Falling back to patching base and 3-way merge...
Auto-merging installing/installing_gcp/preparing-to-install-on-gcp.adoc
Auto-merging installing/installing_gcp/installing-gcp-customizations.adoc
CONFLICT (content): Merge conflict in installing/installing_gcp/installing-gcp-customizations.adoc
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0001 OCPBUGS-58062:GCP credential fix

In response to this:

/cherrypick enterprise-4.17

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@ShaunaDiaz
Copy link
Contributor

ShaunaDiaz commented Nov 18, 2025

Looks like some manual CPs needed @brendan-daly-red-hat

This was referenced Nov 18, 2025
Merged
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ShaunaDiaz ShaunaDiaz ShaunaDiaz left review comments

+2 more reviewers

@jstuever jstuever jstuever requested changes

@jianli-wei jianli-wei jianli-wei requested changes

Reviewers whose approvals may not affect merge requirements

Assignees

@jianli-wei jianli-wei

@ShaunaDiaz ShaunaDiaz

Labels

branch/enterprise-4.17 branch/enterprise-4.18 branch/enterprise-4.19 branch/enterprise-4.20 branch/enterprise-4.21 lgtm Indicates that a PR is ready to be merged. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.

Projects

None yet

Milestone

Continuous Release

Development

Successfully merging this pull request may close these issues.

7 participants

@brendan-daly-red-hat @ocpdocs-previewbot @jianli-wei @ShaunaDiaz @openshift-cherrypick-robot @jstuever @openshift-merge-robot