OCPBUGS-114669: Enable GCP custom universe domain support for CCO by rochacbruno · Pull Request #1083 · openshift/cloud-credential-operator

rochacbruno · 2026-08-27T14:43:05Z

Backport of #1068 to release-4.22.

Cherry-picks the GCP client and service-account changes that add support for custom (alternate) universe domains:

Set the universe domain on GCP API clients
Support domain-scoped service account email formatting
Replace the deprecated CredentialsFromJSON usage

It also bumps google.golang.org/api v0.252.0 -> v0.258.0, the minimal version providing option.WithAuthCredentialsJSON and option.CredentialsType used by the cherry-picked code. k8s.io/api stays at v0.35.2 and github.com/openshift/api is unchanged.

Note: the companion ccoctl change (#1073) is intentionally NOT included here. It depends on the GCPPlatformStatus.UniverseDomain field from openshift/api #2963 (CORS-4417), which has not yet been backported to openshift/api release-4.22.

Sets the universe domain when initializing GCP clients in order to support running in environments with non-default universe domains such as Google Cloud Dedicated, GCP's sovereign cloud offering. CCO will always use JSON-based creds, either service account with key or WIF. We must utilize the WithAuthCredentialsJSON function because it will use self-signed JWTs rather than oauth token exchange which fails in GCD. The authentication falls back to WithCredentials, as ccoctl can authenticate via the metadata server (obtaining credentials from the service account attached to a VM). (cherry picked from commit 8155da6)

In some cases, such as Google Dedicated Cloud, service accounts take on a different format. When the project has the format eu0:PROJECT_ID, the service account has the format: serviceAccount:SERVICE_ACCOUNT_NAME@PROJECT_ID.eu0.iam.gserviceaccount.com This commit adds some simnple handling for this case. (cherry picked from commit c284a20)

Updates from CredentialsFromJSON -> CredentialsFromJSONWithType to avoid using the deprecated function. This change is a no-op, only intended to avoid deprecation warnings. The new function takes a credential type parameter, which can be used to limit accepted credentials types, which is useful for validating credentials provided by external third parties. For OpenShift, cluster credentials are coming from first party users running clusters in their project, so we do not need to limit which credentials are accepted; therefore we just pass the type through from the credential to the function. (cherry picked from commit aeb83ab)

Needed for new GCP packages. Makes local consistent with Dockerfile. (cherry picked from commit a6a3575)

The GCP client and service account changes cherry-picked from openshift#1068 use option.WithAuthCredentialsJSON and option.CredentialsType, which were added in google.golang.org/api v0.258.0. The release-4.22 baseline was v0.252.0. This is the minimal bump that provides those symbols; k8s.io/api stays at v0.35.2 and github.com/openshift/api is unchanged.

openshift-merge-bot · 2026-08-27T14:43:08Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

coderabbitai · 2026-08-27T14:43:13Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fd269a92-82b4-40e9-8cdc-c984e32c1dc7

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

_{Comment @coderabbitai help to get the list of available commands.}

rochacbruno · 2026-08-27T14:43:16Z

/jira cherrypick OCPBUGS-112145

openshift-ci-robot · 2026-08-27T14:44:26Z

@rochacbruno: Jira Issue OCPBUGS-112145 has been cloned as Jira Issue OCPBUGS-114669. Will retitle bug to link to clone.
/retitle OCPBUGS-114669: Enable GCP custom universe domain support for CCO

Details

In response to this:

/jira cherrypick OCPBUGS-112145

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-08-27T14:44:44Z

@rochacbruno: This pull request references Jira Issue OCPBUGS-114669, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected dependent Jira Issue OCPBUGS-112145 to be in one of the following states: MODIFIED, ON_QA, VERIFIED, but it is New instead
expected dependent Jira Issue OCPBUGS-112145 to target a version in 5.0.0, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Backport of #1068 to release-4.22.

Cherry-picks the GCP client and service-account changes that add support for custom (alternate) universe domains:

Set the universe domain on GCP API clients

Support domain-scoped service account email formatting

Replace the deprecated CredentialsFromJSON usage

It also bumps google.golang.org/api v0.252.0 -> v0.258.0, the minimal version providing option.WithAuthCredentialsJSON and option.CredentialsType used by the cherry-picked code. k8s.io/api stays at v0.35.2 and github.com/openshift/api is unchanged.

Note: the companion ccoctl change (#1073) is intentionally NOT included here. It depends on the GCPPlatformStatus.UniverseDomain field from openshift/api #2963 (CORS-4417), which has not yet been backported to openshift/api release-4.22.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-08-27T14:45:50Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: rochacbruno
Once this PR has been reviewed and has the lgtm label, please assign jstuever for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rochacbruno · 2026-08-27T14:48:02Z

/jira refresh

openshift-ci-robot · 2026-08-27T14:48:10Z

@rochacbruno: This pull request references Jira Issue OCPBUGS-114669, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.22.0) matches configured target version for branch (4.22.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
release note type set to "Release Note Not Required"
dependent bug Jira Issue OCPBUGS-112145 is in the state MODIFIED, which is one of the valid states (MODIFIED, ON_QA, VERIFIED)
dependent Jira Issue OCPBUGS-112145 targets the "5.0.0" version, which is one of the valid target versions: 5.0.0
bug has dependents

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

codecov · 2026-08-27T14:58:13Z

Codecov Report

❌ Patch coverage is 17.02128% with 39 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.80%. Comparing base (c69fe7e) to head (1b19270).

Files with missing lines	Patch %	Lines
pkg/gcp/client.go	0.00%	30 Missing ⚠️
pkg/gcp/mock/client_generated.go	37.50%	5 Missing ⚠️
pkg/cmd/provisioning/gcp/credentials.go	0.00%	4 Missing ⚠️

Additional details and impacted files

@@               Coverage Diff                @@
##           release-4.22    #1083      +/-   ##
================================================
- Coverage         46.88%   46.80%   -0.09%     
================================================
  Files                98       98              
  Lines             12558    12594      +36     
================================================
+ Hits               5888     5894       +6     
- Misses             6015     6045      +30     
  Partials            655      655

Files with missing lines	Coverage Δ
pkg/gcp/actuator/serviceaccount.go	`84.93% <100.00%> (+0.64%)`	⬆️
pkg/cmd/provisioning/gcp/credentials.go	`0.00% <0.00%> (ø)`
pkg/gcp/mock/client_generated.go	`83.18% <37.50%> (-1.11%)`	⬇️
pkg/gcp/client.go	`0.00% <0.00%> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

tthvo · 2026-08-27T19:40:36Z

/test security verify-deps

openshift-ci · 2026-08-27T19:49:14Z

@rochacbruno: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/security	`1b19270`	link	true	`/test security`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tthvo · 2026-08-27T20:13:25Z

@@ -1,4 +1,4 @@
-FROM golang:1.21 AS builder
+FROM golang:1.26 AS builder


Suggested change

FROM golang:1.26 AS builder

FROM golang:1.25 AS builder

I wonder if we can use go v1.25 instead here since 4.22 release is built with go v1.25? My guess is "yes" based on: https://github.com/googleapis/google-api-go-client/blob/182ae992632d7ba19b5d3c60c71bda28fbfabca1/go.mod#L3

patrickdillon and others added 5 commits August 27, 2026 14:43

Dockerfile.local: bump go to 1.26

268664d

Needed for new GCP packages. Makes local consistent with Dockerfile. (cherry picked from commit a6a3575)

openshift-ci Bot changed the title ~~Enable GCP custom universe domain support for CCO~~ OCPBUGS-114669: Enable GCP custom universe domain support for CCO Aug 27, 2026

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 27, 2026

openshift-ci Bot requested review from 2uasimojo and dlom August 27, 2026 14:45

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Aug 27, 2026

tthvo reviewed Aug 27, 2026

View reviewed changes

patrickdillon mentioned this pull request Aug 29, 2026

OCPBUGS-114639: OCPBUGS-112550, OCPBUGS-112549: Release 4.22 GCD and KMS support openshift/installer#10783

Open

Navigation Menu

Uh oh!

OCPBUGS-114669: Enable GCP custom universe domain support for CCO - #1083

OCPBUGS-114669: Enable GCP custom universe domain support for CCO#1083
rochacbruno wants to merge 5 commits into
openshift:release-4.22from
rochacbruno:backport-1068-release-4.22

rochacbruno commented Aug 27, 2026 •

edited by openshift-ci Bot

Loading

Uh oh!

openshift-merge-bot Bot commented Aug 27, 2026

Uh oh!

coderabbitai Bot commented Aug 27, 2026

Review skipped

Uh oh!

rochacbruno commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Uh oh!

openshift-ci Bot commented Aug 27, 2026

Uh oh!

rochacbruno commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Uh oh!

codecov Bot commented Aug 27, 2026

Uh oh!

tthvo commented Aug 27, 2026

Uh oh!

openshift-ci Bot commented Aug 27, 2026

Uh oh!

tthvo Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -1,4 +1,4 @@
		FROM golang:1.21 AS builder
		FROM golang:1.26 AS builder

Uh oh!

Conversation

rochacbruno commented Aug 27, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Aug 27, 2026

Uh oh!

coderabbitai Bot commented Aug 27, 2026

Review skipped

Uh oh!

rochacbruno commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Uh oh!

openshift-ci Bot commented Aug 27, 2026

Uh oh!

rochacbruno commented Aug 27, 2026

Uh oh!

openshift-ci-robot commented Aug 27, 2026

Uh oh!

codecov Bot commented Aug 27, 2026

Codecov Report

Uh oh!

tthvo commented Aug 27, 2026

Uh oh!

openshift-ci Bot commented Aug 27, 2026

Uh oh!

tthvo Aug 27, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rochacbruno commented Aug 27, 2026 •

edited by openshift-ci Bot

Loading