CORS-4414: Use regional KMS key for GCP KMS encryption

[rochacbruno]

Summary

• Switch GCP KMS key location from global to ${LEASED_RESOURCE} (regional)
• GCS (used for bootstrap ignition) does not support global KMS keys, causing the e2e-gcp-kms-encryption job to fail (see CORS-4391: GCP: Encrypt Storage Registry and Bootstrap Ignition with KMS Key installer#10734)
• The key is now co-located with the cluster in the same region

Test plan

• Rehearsal job e2e-gcp-kms-encryption passes with the regional KMS key
• Bootstrap ignition GCS bucket is encrypted with the regional KMS key
• Image registry GCS bucket is encrypted with the regional KMS key

Summary by CodeRabbit

• Configure GCP KMS keys in ${LEASED_RESOURCE} instead of global.
• Keep the KMS key in the cluster’s regional location for GCS compatibility.
• Share the selected location with downstream CI steps.
• Update documentation for regional key reuse across CI runs.
• This fixes regional encryption for bootstrap ignition and image registry GCS buckets.

[openshift-ci-robot]

@rochacbruno: This pull request references CORS-4414 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

• Switch GCP KMS key location from global to ${LEASED_RESOURCE} (regional)
• GCS (used for bootstrap ignition) does not support global KMS keys, causing the e2e-gcp-kms-encryption job to fail (see CORS-4391: GCP: Encrypt Storage Registry and Bootstrap Ignition with KMS Key installer#10734)
• The key is now co-located with the cluster in the same region

Test plan

• Rehearsal job e2e-gcp-kms-encryption passes with the regional KMS key
• Bootstrap ignition GCS bucket is encrypted with the regional KMS key
• Image registry GCS bucket is encrypted with the regional KMS key

/cc @rochacbruno

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@rochacbruno: GitHub didn't allow me to request PR reviews from the following users: rochacbruno.

Note that only openshift members and repo collaborators can review this PR, and authors cannot review their own PRs.

Details

In response to this:

Summary

• Switch GCP KMS key location from global to ${LEASED_RESOURCE} (regional)
• GCS (used for bootstrap ignition) does not support global KMS keys, causing the e2e-gcp-kms-encryption job to fail (see CORS-4391: GCP: Encrypt Storage Registry and Bootstrap Ignition with KMS Key installer#10734)
• The key is now co-located with the cluster in the same region

Test plan

• Rehearsal job e2e-gcp-kms-encryption passes with the regional KMS key
• Bootstrap ignition GCS bucket is encrypted with the regional KMS key
• Image registry GCS bucket is encrypted with the regional KMS key

/cc @rochacbruno

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[coderabbitai]

Walkthrough

KMS resources now use the leased resource location instead of global. Documentation states that the regional key is co-located with the cluster and reused only within the same region.

Changes

Regional KMS provisioning

Layer / File(s)	Summary
Regional KMS location and documentation ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh, ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml, ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml	KMS provisioning uses LEASED_RESOURCE. The documentation describes regional placement, GCS regional-key requirements, and region-scoped key reuse.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The patch changes one shell assignment and YAML documentation only; it adds no Ginkgo test declarations or test titles.
Test Structure And Quality	✅ Passed	The PR changes only one shell script and two YAML documentation files; it adds no Ginkgo test code or It blocks to assess.
Microshift Test Compatibility	✅ Passed	The PR changes only KMS provisioning and workflow documentation; it adds no Ginkgo tests or new MicroShift-incompatible API usage.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The patch changes one shell variable and documentation only; it adds or modifies no Ginkgo e2e tests, so SNO compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The patch changes only a GCP KMS location and CI documentation; it adds no deployment, operator, controller, or pod scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	The PR changes one shell script and two YAML files; no Go/OTE binary or suite setup code is modified, so the stdout contract is not applicable.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit only changes KMS provisioning and workflow documentation; it adds no Ginkgo tests or IPv4 assumptions or external-connectivity logic.
No-Weak-Crypto	✅ Passed	The PR only changes KMS LOCATION from global to LEASED_RESOURCE and documentation; no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons are introduced.
Container-Privileges	✅ Passed	The PR changes only KMS location and documentation. The changed step and workflow contain no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root settings.
No-Sensitive-Data-In-Logs	✅ Passed	The only executable change uses LEASED_RESOURCE as a region; logs expose resource names, the region, and existing service-account identities, not passwords, tokens, keys, PII, or customer data.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the change from a global KMS key to a regional KMS key for GCP KMS encryption.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[rochacbruno]

/cc @patrickdillon

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@rochacbruno: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-installer-main-e2e-gcp-kms-encryption	openshift/installer	presubmit	Registry content changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In
`@ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh`:
- Line 24: Update the LOCATION assignment in the KMS provisioning script to
extract the region prefix from LEASED_RESOURCE values such as
us-central1--gcp-quota-slice-00, rather than using the full lease name. Validate
that the extracted prefix is a valid region before passing LOCATION to the
gcloud KMS operations, and fail clearly when extraction or validation fails.

In
`@ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml`:
- Around line 21-23: Update the lifecycle note near the KMS workflow
configuration to accurately state that the key ring and crypto key intentionally
remain after tests for reuse across CI runs in the same region; remove the
incorrect claim that KMS keys cannot be deleted and can only be disabled.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a0c01a87-983b-4ed0-aa86-22516f305ead

📥 Commits

Reviewing files that changed from the base of the PR and between 00a8602 and 0e2e4fd.

📒 Files selected for processing (3)

• ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh
• ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml
• ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml

[patrickdillon]

/pj-rehearse

[patrickdillon]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: patrickdillon, rochacbruno

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• ci-operator/step-registry/gcp/provision/kms-key/OWNERS [patrickdillon,rochacbruno]
• ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/OWNERS [patrickdillon,rochacbruno]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-merge-bot]

@patrickdillon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[openshift-ci]

@rochacbruno: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/rehearse/openshift/installer/main/e2e-gcp-kms-encryption	0e2e4fd	link	unknown	/pj-rehearse pull-ci-openshift-installer-main-e2e-gcp-kms-encryption
ci/rehearse/openshift/installer/release-5.0/e2e-gcp-kms-encryption	0e2e4fd	link	unknown	/pj-rehearse pull-ci-openshift-installer-release-5.0-e2e-gcp-kms-encryption
ci/rehearse/openshift/installer/release-4.23/e2e-gcp-kms-encryption	0e2e4fd	link	unknown	/pj-rehearse pull-ci-openshift-installer-release-4.23-e2e-gcp-kms-encryption
ci/rehearse/openshift/installer/release-5.1/e2e-gcp-kms-encryption	0e2e4fd	link	unknown	/pj-rehearse pull-ci-openshift-installer-release-5.1-e2e-gcp-kms-encryption

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[patrickdillon]

/pj-rehearse ack

[openshift-merge-bot]

@patrickdillon: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.