Skip to content

feat(GCP-431): pass network service account to hypershift GCP e2e tests - #77415

Merged
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
apahim:cncc
Apr 30, 2026
Merged

feat(GCP-431): pass network service account to hypershift GCP e2e tests#77415
openshift-merge-bot[bot] merged 1 commit into
openshift:mainfrom
apahim:cncc

Conversation

@apahim

@apahim apahim commented Apr 6, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Extract the cloud-network service account created by hypershift create iam gcp and pass it as --e2e.gcp-network-sa to the e2e test binary so the cloud-network-config-controller pod gets WIF credentials.
  • Follows the same pattern as all other service accounts (controlplane, nodepool, cloudcontroller, storage, imageregistry).

Dependencies

⚠️ /hold — This PR depends on openshift/hypershift#7824 (GCP-431: CNCC WIF support).
Rehearsal jobs are expected to fail until that PR merges and images rebuild.
Remove hold after hypershift#7824 merges.

Changes

  • ci-operator/step-registry/hypershift/gcp/hosted-cluster-setup/hypershift-gcp-hosted-cluster-setup-commands.sh: Extract NETWORK_SA from IAM output and save to ${SHARED_DIR}/network-sa
  • ci-operator/step-registry/hypershift/gcp/run-e2e/hypershift-gcp-run-e2e-commands.sh: Read network-sa and pass --e2e.gcp-network-sa to e2e binary

Test plan

🤖 Generated with Claude Code

@apahim @claude
feat(GCP-431): pass network service account to hypershift GCP e2e tests
8079b35 
Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@apahim

apahim commented Apr 6, 2026

Copy link
Copy Markdown
Contributor Author

/hold

@openshift-ci openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 6, 2026
@openshift-ci
openshift-ci Bot requested review from cblecker and muraee April 6, 2026 10:46
@openshift-ci openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 6, 2026
@openshift-ci-robot

openshift-ci-robot commented Apr 6, 2026

Copy link
Copy Markdown
Contributor

[REHEARSALNOTIFIER]
@apahim: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name Repo Type Reason
pull-ci-openshift-hypershift-main-e2e-gke openshift/hypershift presubmit Registry content changed
pull-ci-openshift-hypershift-release-5.0-e2e-gke openshift/hypershift presubmit Registry content changed
pull-ci-openshift-hypershift-release-4.23-e2e-gke openshift/hypershift presubmit Registry content changed
pull-ci-openshift-hypershift-release-4.22-e2e-gke openshift/hypershift presubmit Registry content changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

@cblecker

cblecker commented Apr 16, 2026

Copy link
Copy Markdown
Member

/lgtm

@openshift-ci openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 16, 2026
@openshift-ci

openshift-ci Bot commented Apr 16, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: apahim, cblecker

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@cblecker

cblecker commented Apr 18, 2026

Copy link
Copy Markdown
Member

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-gke
/pj-rehearse pull-ci-openshift-hypershift-main-e2e-v2-gke

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 18, 2026

Copy link
Copy Markdown
Contributor

@cblecker: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 18, 2026

Copy link
Copy Markdown
Contributor

@cblecker: requesting more than one rehearsal in one comment is not supported. If you would like to rehearse multiple specific jobs, please separate the job names by a space in a single command.

@cblecker

cblecker commented Apr 18, 2026

Copy link
Copy Markdown
Member

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-v2-gke

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 18, 2026

Copy link
Copy Markdown
Contributor

@cblecker: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@cblecker

cblecker commented Apr 23, 2026

Copy link
Copy Markdown
Member

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-gke pull-ci-openshift-hypershift-main-e2e-v2-gke

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 23, 2026

Copy link
Copy Markdown
Contributor

@cblecker: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-ci

openshift-ci Bot commented Apr 23, 2026

Copy link
Copy Markdown
Contributor

@apahim: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/rehearse/openshift/hypershift/main/e2e-gke 8079b35 link unknown /pj-rehearse pull-ci-openshift-hypershift-main-e2e-gke
ci/rehearse/openshift/hypershift/main/e2e-v2-gke 8079b35 link unknown /pj-rehearse pull-ci-openshift-hypershift-main-e2e-v2-gke

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

This was referenced Apr 26, 2026
Closed
Merged
@cblecker

cblecker commented Apr 30, 2026

Copy link
Copy Markdown
Member

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-gke

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

@cblecker: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@cblecker

cblecker commented Apr 30, 2026

Copy link
Copy Markdown
Member

/pj-rehearse pull-ci-openshift-hypershift-main-e2e-gke

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

@cblecker: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@cblecker

cblecker commented Apr 30, 2026

Copy link
Copy Markdown
Member

/pj-rehearse skip

@openshift-merge-bot

openshift-merge-bot Bot commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

@cblecker: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

@openshift-merge-bot openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label Apr 30, 2026
@cblecker

cblecker commented Apr 30, 2026

Copy link
Copy Markdown
Member

/hold cancel

@openshift-ci openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 30, 2026
@openshift-merge-bot
openshift-merge-bot Bot merged commit 1d73cfc into openshift:main Apr 30, 2026
10 of 12 checks passed
@cblecker cblecker mentioned this pull request Apr 30, 2026
Merged
1 task
@openshift-merge-bot

openshift-merge-bot Bot commented Apr 30, 2026

Copy link
Copy Markdown
Contributor

@cblecker, pj-rehearse: unable prepare a candidate for rehearsal; rehearsals will not be run. This could be due to a branch that needs to be rebased. ERROR:

couldn't checkout base SHA e7dea04902303f25b59ec746e6edd16d7337dc8c: error checking out "e7dea04902303f25b59ec746e6edd16d7337dc8c": exit status 128 fatal: unable to read tree (e7dea04902303f25b59ec746e6edd16d7337dc8c)

openshift-merge-bot Bot pushed a commit that referenced this pull request May 1, 2026
@cblecker
feat(GCP-431): pass network service account to v2 GKE create chain (#…
e18f6f9 
…78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to #77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
BATMAN-JD pushed a commit to BATMAN-JD/release that referenced this pull request May 1, 2026
@apahim @claude @BATMAN-JD
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
1457812 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
mhanss pushed a commit to mhanss/release that referenced this pull request May 26, 2026
@apahim @claude @mhanss
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
2ee1f0e 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
mhanss pushed a commit to mhanss/release that referenced this pull request May 26, 2026
@cblecker @mhanss
feat(GCP-431): pass network service account to v2 GKE create chain (o…
0734eae 
…penshift#78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to openshift#77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
andrej1991 pushed a commit to andrej1991/release that referenced this pull request Jul 6, 2026
@apahim @claude @andrej1991
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
b521a90 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
andrej1991 pushed a commit to andrej1991/release that referenced this pull request Jul 6, 2026
@cblecker @andrej1991
feat(GCP-431): pass network service account to v2 GKE create chain (o…
002c91f 
…penshift#78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to openshift#77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
TimurMP pushed a commit to TimurMP/release that referenced this pull request Jul 8, 2026
@apahim @claude @TimurMP
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
c95a3b2 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
TimurMP pushed a commit to TimurMP/release that referenced this pull request Jul 8, 2026
@cblecker @TimurMP
feat(GCP-431): pass network service account to v2 GKE create chain (o…
3d903d9 
…penshift#78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to openshift#77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
SachinNinganure pushed a commit to SachinNinganure/release that referenced this pull request Jul 20, 2026
@apahim @claude @SachinNinganure-zz
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
2a76ff5 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
SachinNinganure pushed a commit to SachinNinganure/release that referenced this pull request Jul 20, 2026
@cblecker @SachinNinganure-zz
feat(GCP-431): pass network service account to v2 GKE create chain (o…
bf5d3a9 
…penshift#78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to openshift#77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
malingatembo pushed a commit to malingatembo/release that referenced this pull request Aug 5, 2026
@apahim @claude @malingatembo
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
1f02a4c 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
malingatembo pushed a commit to malingatembo/release that referenced this pull request Aug 5, 2026
@cblecker @malingatembo
feat(GCP-431): pass network service account to v2 GKE create chain (o…
d3d3f54 
…penshift#78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to openshift#77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
TimurMP pushed a commit to TimurMP/release that referenced this pull request Sep 5, 2026
@apahim @claude @TimurMP
feat(GCP-431): pass network service account to hypershift GCP e2e tes…
700e4d0 
…ts (openshift#77415)

Extract the cloud-network SA created by hypershift create iam gcp and
pass it as --e2e.gcp-network-sa to the e2e test binary so the
cloud-network-config-controller pod gets WIF credentials.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
TimurMP pushed a commit to TimurMP/release that referenced this pull request Sep 5, 2026
@cblecker @TimurMP
feat(GCP-431): pass network service account to v2 GKE create chain (o…
cbf051c 
…penshift#78662)

The v2 GKE e2e workflow (hypershift-gcp-gke-e2e-v2) creates a hosted
cluster directly via the hypershift CLI in the hypershift-gcp-create
chain. Since openshift/hypershift#7824 made --network-service-account a
required flag, the chain must read the network SA saved to SHARED_DIR by
hypershift-gcp-hosted-cluster-setup and forward it to the CLI.

This is a follow-up to openshift#77415, which fixed the same
issue for the v1 (hypershift-gcp-run-e2e) flow.

Assisted-by: Claude:claude-opus-4-6[1m]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@cblecker cblecker Awaiting requested review from cblecker
@muraee muraee Awaiting requested review from muraee

Assignees

@cblecker cblecker

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. rehearsals-ack Signifies that rehearsal jobs have been acknowledged

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@apahim @openshift-ci-robot @cblecker