CORS-4550: bump openshift api for gcd feature gate

data/data/install.openshift.io_installconfigs.yaml

@@ -7010,7 +7010,7 @@ spec:
                         name:
                           description: |-
                             name is the name of the IBM Cloud service.
-                            Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, or VPC.
+                            Possible values are: CIS, COS, COSConfig, DNSServices, GlobalCatalog, GlobalSearch, GlobalTagging, HyperProtect, IAM, KeyProtect, ResourceController, ResourceManager, VPC, TransitGateway, or PowerVS.
                             For example, the IBM Cloud Private IAM service could be configured with the
                             service `name` of `IAM` and `url` of `https://private.iam.cloud.ibm.com`
                             Whereas the IBM Cloud Private VPC service for US South (Dallas) could be configured
@@ -7029,6 +7029,8 @@ spec:
                           - ResourceController
                           - ResourceManager
                           - VPC
+                          - TransitGateway
+                          - PowerVS
                           type: string
                         url:
                           description: |-
@@ -8402,6 +8404,7 @@ spec:
                           - ResourceController
                           - ResourceManager
                           - VPC
+                          - TransitGateway
                           type: string
                         url:
                           description: |-

go.mod

@@ -70,7 +70,7 @@ require (
 	github.com/nutanix-cloud-native/cluster-api-provider-nutanix v1.10.3
 	github.com/nutanix-cloud-native/prism-go-client v0.8.0
 	github.com/onsi/gomega v1.42.1
-	github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05
+	github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3
 	github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120
 	github.com/openshift/assisted-service/api v0.0.0-20260722223301-f50c5b20c7e1
 	github.com/openshift/assisted-service/client v0.0.0

go.sum

@@ -879,8 +879,8 @@ github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJw
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
 github.com/opencontainers/runtime-spec v1.2.1 h1:S4k4ryNgEpxW1dzyqffOmhI1BHYcjzU8lpJfSlR0xww=
 github.com/opencontainers/runtime-spec v1.2.1/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
-github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05 h1:Ti5JDaDKqhnB0xFb/y/ZeOPR+v+GZANAkZZ7shVLKWA=
-github.com/openshift/api v0.0.0-20260812104507-9d7eaabdfe05/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M=
+github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3 h1:JRsHyxZTqcs5MK0LYTsyzs9VMdO02cSYMBvyize1fhI=
+github.com/openshift/api v0.0.0-20260825094607-13a84dedc5a3/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M=
 github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120 h1:fxnvVDuqfnAz9jCuritFrsb6IK33dxc/MxC9Gtv+nlk=
 github.com/openshift/assisted-image-service v0.0.0-20260428115106-2b81dd8e7120/go.mod h1:eLxB7EHTDEvuJHobsVZsyMKOFkVATz4aGAwNtSGMdyM=
 github.com/openshift/assisted-service/api v0.0.0-20260722223301-f50c5b20c7e1 h1:CQULurVWElnk8kTQflgNZcu82xcw4DQzwvv2PPC33i4=

pkg/asset/manifests/infrastructure.go

@@ -11,7 +11,6 @@ import (
 	"sigs.k8s.io/yaml"
 
 	configv1 "github.com/openshift/api/config/v1"
-	"github.com/openshift/api/features"
 	"github.com/openshift/installer/pkg/asset"
 	"github.com/openshift/installer/pkg/asset/installconfig"
 	gcpic "github.com/openshift/installer/pkg/asset/installconfig/gcp"
@@ -227,18 +226,16 @@ func (i *Infrastructure) Generate(ctx context.Context, dependencies asset.Parent
 			config.Status.PlatformStatus.GCP.ResourceTags = resourceTags
 		}
 
-		if installConfig.Config.Enabled(features.FeatureGateGCPSovereignCloudInstall) {
-			ssn, err := gcpic.GetSession(ctx)
-			if err != nil {
-				return fmt.Errorf("could not get GCP session: %w", err)
-			}
-			ud, err := ssn.Credentials.GetUniverseDomain()
-			if err != nil {
-				return fmt.Errorf("could not get GCP universe domain: %w", err)
-			}
-			if gcp.IsNonDefaultUniverseDomain(ud) {
-				config.Status.PlatformStatus.GCP.UniverseDomain = ud
-			}
+		ssn, err := gcpic.GetSession(ctx)
+		if err != nil {
+			return fmt.Errorf("could not get GCP session: %w", err)
+		}
+		ud, err := ssn.Credentials.GetUniverseDomain()
+		if err != nil {
+			return fmt.Errorf("could not get GCP universe domain: %w", err)
+		}
+		if gcp.IsNonDefaultUniverseDomain(ud) {
+			config.Status.PlatformStatus.GCP.UniverseDomain = ud
 		}
 
 		// If the user has requested the use of a DNS provisioned by them, then OpenShift needs to

pkg/asset/manifests/infrastructure_test.go

@@ -2,9 +2,13 @@ package manifests
 
 import (
 	"context"
+	"fmt"
+	"os"
+	"path/filepath"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/yaml"
 
@@ -37,6 +41,9 @@ func TestGenerateInfrastructure(t *testing.T) {
 		installConfig          *types.InstallConfig
 		expectedInfrastructure *configv1.Infrastructure
 		expectedFilesGenerated int
+		// setup, when non-nil, runs before the asset is generated. Platforms
+		// that reach a cloud API during Generate can use it to stub credentials.
+		setup func(t *testing.T)
 	}{{
 		name:          "vanilla aws",
 		installConfig: icBuild.build(icBuild.forAWS()),
@@ -71,6 +78,7 @@ func TestGenerateInfrastructure(t *testing.T) {
 	}, {
 		name:          "default GCP custom DNS",
 		installConfig: icBuild.build(icBuild.forGCP()),
+		setup:         mockGCPCredentials("googleapis.com"),
 		expectedInfrastructure: infraBuild.build(
 			infraBuild.forPlatform(configv1.GCPPlatformType),
 			infraBuild.withGCPClusterHostedDNS("Disabled"),
@@ -82,11 +90,22 @@ func TestGenerateInfrastructure(t *testing.T) {
 			icBuild.forGCP(),
 			icBuild.withGCPUserProvisionedDNS("Enabled"),
 		),
+		setup: mockGCPCredentials("googleapis.com"),
 		expectedInfrastructure: infraBuild.build(
 			infraBuild.forPlatform(configv1.GCPPlatformType),
 			infraBuild.withGCPClusterHostedDNS("Enabled"),
 		),
 		expectedFilesGenerated: 2,
+	}, {
+		name:          "GCP non-default universe domain",
+		installConfig: icBuild.build(icBuild.forGCP()),
+		setup:         mockGCPCredentials("test.googleapis.com"),
+		expectedInfrastructure: infraBuild.build(
+			infraBuild.forPlatform(configv1.GCPPlatformType),
+			infraBuild.withGCPClusterHostedDNS("Disabled"),
+			infraBuild.withGCPUniverseDomain("test.googleapis.com"),
+		),
+		expectedFilesGenerated: 2,
 	}, {
 		name:          "default AWS custom DNS",
 		installConfig: icBuild.build(icBuild.forAWS()),
@@ -284,6 +303,10 @@ func TestGenerateInfrastructure(t *testing.T) {
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
+			if tc.setup != nil {
+				tc.setup(t)
+			}
+
 			parents := asset.Parents{}
 			parents.Add(
 				&installconfig.ClusterID{
@@ -628,6 +651,13 @@ func (b infraBuildNamespace) withGCPPlatformStatus() infraOption {
 	}
 }
 
+func (b infraBuildNamespace) withGCPUniverseDomain(domain string) infraOption {
+	return func(infra *configv1.Infrastructure) {
+		b.withGCPPlatformStatus()(infra)
+		infra.Status.PlatformStatus.GCP.UniverseDomain = domain
+	}
+}
+
 func (b infraBuildNamespace) withGCPClusterHostedDNS(enabled string) infraOption {
 	return func(infra *configv1.Infrastructure) {
 		b.withGCPPlatformStatus()(infra)
@@ -731,3 +761,28 @@ func (b infraBuildNamespace) withVSphereIngressVIP(vip string) infraOption {
 		infra.Status.PlatformStatus.VSphere.IngressIPs = append(infra.Status.PlatformStatus.VSphere.IngressIPs, vip)
 	}
 }
+
+// mockGCPCredentials returns a setup func that points the GCP session loader at
+// a throwaway service_account credentials file so unit tests need no real
+// credentials. The service_account type lets the test set the reported universe domain.
+func mockGCPCredentials(universeDomain string) func(t *testing.T) {
+	return func(t *testing.T) {
+		t.Helper()
+
+		creds := fmt.Sprintf(`{
+  "type": "service_account",
+  "project_id": "fake-project",
+  "private_key": "fake",
+  "client_email": "fake@fake-project.iam.gserviceaccount.com",
+  "token_uri": "https://oauth2.googleapis.com/token",
+  "universe_domain": %q
+}`, universeDomain)
+
+		path := filepath.Join(t.TempDir(), "gcp-creds.json")
+		require.NoError(t, os.WriteFile(path, []byte(creds), 0o600))
+		// GOOGLE_APPLICATION_CREDENTIALS is the first entry in the session loader
+		// chain, so this takes precedence over any real credentials in the
+		// environment. t.Setenv restores the previous value after the test.
+		t.Setenv("GOOGLE_APPLICATION_CREDENTIALS", path)
+	}
+}