From 0e2e4fd731ca3725411116d32d9ba3623e9bf9d9 Mon Sep 17 00:00:00 2001 From: Bruno Cesar Rocha Date: Mon, 3 Aug 2026 14:32:01 +0100 Subject: [PATCH] CORS-4414: Use regional KMS key instead of global for GCP KMS encryption GCS (used for bootstrap ignition) does not support global KMS keys. Switch the KMS key location from "global" to the LEASED_RESOURCE region so the key is co-located with the cluster and compatible with GCS bucket encryption. Co-Authored-By: Claude Opus 4.6 --- .../gcp/provision/kms-key/gcp-provision-kms-key-commands.sh | 2 +- .../gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml | 5 +++-- .../openshift-e2e-gcp-kms-encryption-workflow.yaml | 6 +++--- 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh index f569d90281277..cfa0f627493dd 100755 --- a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh +++ b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-commands.sh @@ -21,7 +21,7 @@ then gcloud config set project "${GOOGLE_PROJECT_ID}" fi -LOCATION="global" +LOCATION="${LEASED_RESOURCE}" KEY_RING_NAME="openshift-ci" KEY_NAME="openshift-ci-e2e" diff --git a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml index 68d585fe0fbd4..2055cfbb7f020 100644 --- a/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml +++ b/ci-operator/step-registry/gcp/provision/kms-key/gcp-provision-kms-key-ref.yaml @@ -12,8 +12,9 @@ ref: memory: 100Mi documentation: |- Ensure a shared GCP Cloud KMS key ring and crypto key exist for CI testing. - Uses a global location so the key is accessible from any region. Both the + Uses the LEASED_RESOURCE region so the key is co-located with the cluster. + GCS (used for bootstrap ignition) requires a regional KMS key. Both the key ring (openshift-ci) and key (openshift-ci-e2e) are created only if they - do not already exist, and are reused across all CI runs. + do not already exist, and are reused across all CI runs in that region. The key details are saved to SHARED_DIR for use by subsequent steps (e.g., ipi-conf-gcp-osdisk-encryption-key). diff --git a/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml b/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml index 6601ce0173e30..0f4b3d4514287 100644 --- a/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml +++ b/ci-operator/step-registry/openshift/e2e/gcp/kms-encryption/openshift-e2e-gcp-kms-encryption-workflow.yaml @@ -13,12 +13,12 @@ workflow: - chain: ipi-gcp-post documentation: |- The GCP KMS encryption workflow ensures a shared customer-managed KMS key - exists (global location, reused across runs), configures install-config + exists (regional, co-located with the cluster), configures install-config with OS disk encryption, installs a cluster, verifies KMS encryption is applied to GCS buckets (bootstrap ignition and image registry), and runs the conformance suite. Note: The KMS keyring and key are NOT deleted after the test completes. This is intentional because GCP does not allow deletion of KMS keys (they - can only be disabled). The same key is reused across all CI runs to avoid - resource accumulation. + can only be disabled). The same key is reused across all CI runs in the + same region to avoid resource accumulation.