[release-5.0] OCPBUGS-114620: bump openshift api for gcd feature gate by openshift-cherrypick-robot · Pull Request #10825 · openshift/installer

openshift-cherrypick-robot · 2026-08-27T14:41:35Z

This is an automated cherry-pick of #10775

/assign barbacbd

Summary by CodeRabbit

New Features
- GCP installations now support custom universe domains, including recording non-default domains in infrastructure status.
Bug Fixes
- Improved GCP domain detection and handling during infrastructure generation.
- Domain retrieval failures continue to be reported instead of being silently ignored.
Chores
- Updated the OpenShift API dependency.

Co-authored-by: Patrick Dillon <padillon@redhat.com>

…te check The GCPSovereignCloudInstall feature gate is now enabled in the default feature set, so gating the universe domain lookup behind it is no-op.

The universe domain lookup is now need for GCP, so the infrastructure manifest generation test needs a stubbed GCP session instead of real credentials. This adds a per-case setup hook and a mockGCPCredentials helper that points the session loader at a throwaway service_account credentials file, letting each case set the reported universe domain.

openshift-merge-bot · 2026-08-27T14:41:38Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-08-27T14:41:38Z

@openshift-cherrypick-robot: Ignoring requests to cherry-pick non-bug issues: CORS-4550

Details

In response to this:

This is an automated cherry-pick of #10775

/assign barbacbd

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-08-27T14:42:02Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 01bcd823-73da-45cd-8c03-1d6392dc9265

📥 Commits

Reviewing files that changed from the base of the PR and between 2497fe7 and 3a00c36.

⛔ Files ignored due to path filters (21)

data/data/install.openshift.io_installconfigs.yaml is excluded by !data/data/install.openshift.io_installconfigs.yaml
go.sum is excluded by !**/*.sum
vendor/github.com/openshift/api/config/v1/types.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/config/v1/types_infrastructure.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/types_cluster_monitoring.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/config/v1alpha1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/features/features.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/features/legacyfeaturegates.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/machine/v1beta1/types_vsphereprovider.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/machineconfiguration/v1/types.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.go is excluded by !vendor/**, !**/vendor/**
vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.go is excluded by !vendor/**, !**/vendor/**, !**/zz_generated*
vendor/modules.txt is excluded by !vendor/**, !**/vendor/**

📒 Files selected for processing (3)

go.mod
pkg/asset/manifests/infrastructure.go
pkg/asset/manifests/infrastructure_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

📝 Walkthrough

Walkthrough

GCP infrastructure generation now retrieves the universe domain without a feature-gate condition. Tests mock service-account credentials and verify default and non-default domain handling.

Changes

GCP universe-domain handling

Layer / File(s)	Summary
Unconditional GCP domain detection `go.mod`, `pkg/asset/manifests/infrastructure.go`	The OpenShift API dependency is updated. GCP infrastructure generation always retrieves the session and universe domain, then records non-default domains in platform status.
Credential setup and domain coverage `pkg/asset/manifests/infrastructure_test.go`	Tests can run setup callbacks before asset generation. GCP cases use temporary mocked credentials and validate default and non-default universe domains.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 3a00c

This change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 13 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1…	Write docstrings for the functions missing them to satisfy the coverage threshold.
Test Structure And Quality	⚠️ Warning	The changed test adds `require.NoError(t, os.WriteFile(...))` without a failure message in `pkg/asset/manifests/infrastructure_test.go`. This violates the assertion-message requirement. The other chec…	Add a meaningful message to the new assertion, for example: `require.NoError(t, os.WriteFile(path, []byte(creds), 0o600), "failed to write mock GCP credentials")`.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the release branch, issue, and primary change: updating the OpenShift API dependency for the GCD feature gate.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request modifies one test file and adds the static case name "GCP non-default universe domain". The table-driven runner uses `t.Run(tc.name)`, but every case name is a string literal, s…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The only test change is in `pkg/asset/manifests/infrastructure_test.go`, which uses the standard `testing` package, `TestGenerateInfrastructure`, and `…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The pull request adds no Ginkgo e2e tests. The changed test file uses Go's `testing` package and `TestGenerateInfrastructure`, with table-driven GCP cases and credential setup. The added cases …
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request introduces no topology-sensitive scheduling constraint. The only non-test production change is in `pkg/asset/manifests/infrastructure.go`; it retrieves and records the GCP unive…
Ote Binary Stdout Contract	✅ Passed	PASS — The pull request adds no process-level stdout write. The production change only retrieves the GCP session and universe domain in `Infrastructure.Generate`. The test additions run inside `TestGe…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The PR adds no new Ginkgo e2e tests. It modifies the existing Go unit test `TestGenerateInfrastructure` in `pkg/asset/manifests/infrastructure_test.go`. The new setup writes temporary credential…
No-Weak-Crypto	✅ Passed	No weak-crypto condition is introduced. The PR diff adds no MD5, SHA-1, DES/3DES, RC4, Blowfish, ECB, custom crypto, or non-constant-time secret/token comparison. The changed GCP path reads and compar…
Container-Privileges	✅ Passed	PASS. The pull request changes GCP infrastructure generation, tests, dependency/vendor data, and CRD schemas. The diff from the release-5.0 base adds no `privileged`, `hostPID`, `hostNetwork`, `hostIP…
No-Sensitive-Data-In-Logs	✅ Passed	No sensitive-data logging was introduced. The production change only retrieves the GCP session and stores a non-default universe domain in infrastructure status. It adds no log call. The existing cred…

Full details: Docstring Coverage

Explanation

Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (1 skipped: 1 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS. The pull request modifies one test file and adds the static case name "GCP non-default universe domain". The table-driven runner uses t.Run(tc.name), but every case name is a string literal, so names do not include generated identifiers, timestamps, node or namespace names, IP addresses, or other run-dependent values. The added title is descriptive and not overly specific.

Full details: Test Structure And Quality

Explanation

The changed test adds require.NoError(t, os.WriteFile(...)) without a failure message in pkg/asset/manifests/infrastructure_test.go. This violates the assertion-message requirement. The other checks are satisfied: the test has no cluster-scoped resources or waits, and t.TempDir() and t.Setenv() register cleanup automatically.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The only test change is in pkg/asset/manifests/infrastructure_test.go, which uses the standard testing package, TestGenerateInfrastructure, and t.Run. Therefore the MicroShift Ginkgo e2e compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS — The pull request adds no Ginkgo e2e tests. The changed test file uses Go's testing package and TestGenerateInfrastructure, with table-driven GCP cases and credential setup. The added cases do not assume multiple nodes, node roles, scheduling across nodes, failover, scaling, draining, or multiple endpoints. The check is therefore not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request introduces no topology-sensitive scheduling constraint. The only non-test production change is in pkg/asset/manifests/infrastructure.go; it retrieves and records the GCP universe domain. The diff adds no Deployment, StatefulSet, DaemonSet, replica, affinity, topology spread, node selector, toleration, or PDB configuration. The remaining changes are tests, dependency metadata, and vendored API/schema updates.

Full details: Ote Binary Stdout Contract

Explanation

PASS — The pull request adds no process-level stdout write. The production change only retrieves the GCP session and universe domain in Infrastructure.Generate. The test additions run inside TestGenerateInfrastructure subtests, use fmt.Sprintf, os.WriteFile for an explicitly opened file, and t.Setenv; they do not write to stdout. Changed vendored API files also contain no fmt.Print*, log.Print*, klog, os.Stdout, suite setup, or init output path.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The PR adds no new Ginkgo e2e tests. It modifies the existing Go unit test TestGenerateInfrastructure in pkg/asset/manifests/infrastructure_test.go. The new setup writes temporary credentials and reads the configured universe domain; it does not connect to the token URL or any external service. No new IPv4-only networking logic appears in the test diff.

Full details: No-Weak-Crypto

Explanation

No weak-crypto condition is introduced. The PR diff adds no MD5, SHA-1, DES/3DES, RC4, Blowfish, ECB, custom crypto, or non-constant-time secret/token comparison. The changed GCP path reads and compares a universe-domain string, not a secret or token. The vendored dependency changes contain API declarations and generated data only.

Full details: Container-Privileges

Explanation

PASS. The pull request changes GCP infrastructure generation, tests, dependency/vendor data, and CRD schemas. The diff from the release-5.0 base adds no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root execution settings. The changed YAML files are CRDs, not workload manifests. The generated infrastructure code does not define container security settings.

Full details: No-Sensitive-Data-In-Logs

Explanation

No sensitive-data logging was introduced. The production change only retrieves the GCP session and stores a non-default universe domain in infrastructure status. It adds no log call. The existing credential loader logs only the credential source, while credential content is explicitly redacted. The test credentials are fake values and are not logged.

Fix all pre-merge checks with AI

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.12.2)

Error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions
The command is terminated due to an error: can't load config: unsupported version of the configuration: "" See https://golangci-lint.run/docs/product/migration-guide for migration instructions

_{Comment @coderabbitai help to get the list of available commands.}

openshift-ci · 2026-08-27T14:42:55Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rwsu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci-robot · 2026-08-27T14:43:09Z

@openshift-cherrypick-robot: This pull request references CORS-4550 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

This is an automated cherry-pick of #10775

/assign barbacbd

Summary by CodeRabbit

New Features

GCP installations now support custom universe domains, including recording non-default domains in infrastructure status.

Bug Fixes

Improved GCP domain detection and handling during infrastructure generation.

Domain retrieval failures continue to be reported instead of being silently ignored.

Chores

Updated the OpenShift API dependency.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

barbacbd · 2026-08-27T14:43:26Z

/retitle [release-5.0] OCPBUGS-114620: bump openshift api for gcd feature gate

openshift-ci-robot · 2026-08-27T14:43:42Z

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-114620, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (5.0.0) matches configured target version for branch (5.0.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note type set to "Release Note Not Required"
dependent bug Jira Issue OCPBUGS-114668 is in the state Verified, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-114668 targets the "5.1.0" version, which is one of the valid target versions: 5.1.0
bug has dependents

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #10775

/assign barbacbd

Summary by CodeRabbit

New Features

GCP installations now support custom universe domains, including recording non-default domains in infrastructure status.

Bug Fixes

Improved GCP domain detection and handling during infrastructure generation.

Domain retrieval failures continue to be reported instead of being silently ignored.

Chores

Updated the OpenShift API dependency.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

barbacbd · 2026-08-27T14:43:55Z

/cc @patrickdillon
/cc @rochacbruno

redhat-chai-bot · 2026-08-27T15:54:27Z

/retest

AI-generated. Review for accuracy.

openshift-ci · 2026-08-27T16:44:35Z

@openshift-cherrypick-robot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tthvo · 2026-08-27T16:54:04Z

 	github.com/nutanix-cloud-native/prism-go-client v0.8.0
 	github.com/onsi/gomega v1.42.1
-	github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05
+	github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3


I guess the o/api PR openshift/api#2991 should be backported to release-5.0 branch and we vendor that commit instead, rite?

This one currently points to main/release-5.1.

Whoop, I just saw openshift/api#3017. Let's wait for it then :D

patrickdillon · 2026-08-27T19:23:55Z

/hold
for openshift/api#3017

tthvo · 2026-08-27T23:14:08Z

The o/api 5.0 backport openshift/api#3017 merged as openshift/api@187a9f9 👍

barbacbd · 2026-09-01T15:33:14Z

closing in favor of #10845

/close

barbacbd · 2026-09-01T15:34:46Z

/close

openshift-ci-robot · 2026-09-01T15:35:40Z

@openshift-cherrypick-robot: This pull request references Jira Issue OCPBUGS-114620. The bug has been updated to no longer refer to the pull request using the external bug tracker.

Details

In response to this:

This is an automated cherry-pick of #10775

/assign barbacbd

Summary by CodeRabbit

New Features

GCP installations now support custom universe domains, including recording non-default domains in infrastructure status.

Bug Fixes

Improved GCP domain detection and handling during infrastructure generation.

Domain retrieval failures continue to be reported instead of being silently ignored.

Chores

Updated the OpenShift API dependency.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-01T15:35:43Z

@barbacbd: Closed this PR.

Details

In response to this:

closing in favor of #10845

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-09-01T15:37:00Z

@barbacbd: Closed this PR.

Details

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

tthvo and others added 5 commits August 27, 2026 14:41

CORS-4550: bump openshift api for gcd feature gate

a44c6dd

Co-authored-by: Patrick Dillon <padillon@redhat.com>

go mod vendor

7f4c1a7

crd: regenerate install-config CRD

f9590ae

gcp: populate universe domain in infrastructure CR without feature ga…

df105bd

…te check The GCPSovereignCloudInstall feature gate is now enabled in the default feature set, so gating the universe domain lookup behind it is no-op.

openshift-cherrypick-robot assigned barbacbd Aug 27, 2026

openshift-cherrypick-robot mentioned this pull request Aug 27, 2026

CORS-4550: bump openshift api for gcd feature gate #10775

Merged

openshift-ci Bot requested review from pawanpinjarkar and rna-afk August 27, 2026 14:42

barbacbd mentioned this pull request Aug 27, 2026

[release-5.0] OCPBUGS-114620: Promote GCD to Default openshift/api#3017

Merged

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Aug 27, 2026

openshift-ci Bot changed the title ~~[release-5.0] CORS-4550: bump openshift api for gcd feature gate~~ [release-5.0] OCPBUGS-114620: bump openshift api for gcd feature gate Aug 27, 2026

openshift-ci-robot added the jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. label Aug 27, 2026

openshift-ci Bot requested review from patrickdillon and rochacbruno August 27, 2026 14:44

tthvo reviewed Aug 27, 2026

View reviewed changes

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Aug 27, 2026

barbacbd mentioned this pull request Sep 1, 2026

OCPBUGS-114620: bump openshift api for gcd feature gate #10845

Open

3 tasks

openshift-ci Bot closed this Sep 1, 2026

Uh oh!

Conversation

openshift-cherrypick-robot commented Aug 27, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

openshift-merge-bot Bot commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

❌ Failed checks (2 warnings)

Uh oh!

openshift-ci Bot commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

barbacbd commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Summary by CodeRabbit

Uh oh!

barbacbd commented Aug 27, 2026

Uh oh!

redhat-chai-bot commented Aug 27, 2026

Uh oh!

openshift-ci Bot commented Aug 27, 2026

Uh oh!

tthvo Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

tthvo Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

patrickdillon commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tthvo commented Aug 27, 2026

Uh oh!

barbacbd commented Sep 1, 2026

Uh oh!

barbacbd commented Sep 1, 2026

Uh oh!

openshift-ci-robot commented Sep 1, 2026

Summary by CodeRabbit

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

openshift-ci Bot commented Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

openshift-cherrypick-robot commented Aug 27, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Aug 27, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Aug 27, 2026 •

edited

Loading

openshift-ci-robot commented Aug 27, 2026 •

edited by openshift-ci Bot

Loading

patrickdillon commented Aug 27, 2026 •

edited

Loading