GCP-431: feat: pass cloud-network SA to GCP HyperShift e2e tests by patjlm · Pull Request #78533 · openshift/release

patjlm · 2026-04-29T08:00:46Z

Summary

Extract cloud-network SA email from IAM output in hosted-cluster-setup step
Pass --e2e.gcp-network-sa flag to e2e test binary in run-e2e step

Context

HyperShift PR openshift/hypershift#7824 added e2e flag plumbing for the CNCC
network service account (--e2e.gcp-network-sa). The CI step needs to extract
the SA email and pass it through.

Dependencies

Requires: GCP-431: feat: Add CNCC support for GCP WIF in HyperShift hypershift#7824 (already merged)

Jira

GCP-431

Summary by CodeRabbit

Release Notes

Chores
- Strengthened validation in cluster setup process with additional identity verification and early failure detection mechanisms.
- Improved persistence and data flow for identity configuration values between cluster setup and testing workflows.
- Updated test execution configuration to properly propagate identity-related parameters through the testing pipeline.

Extract the cloud-network (CNCC) service account email from the IAM output and pass it to the e2e test binary via --e2e.gcp-network-sa. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci-robot · 2026-04-29T08:00:50Z

@patjlm: This pull request references GCP-431 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary

Extract cloud-network SA email from IAM output in hosted-cluster-setup step

Pass --e2e.gcp-network-sa flag to e2e test binary in run-e2e step

Context

HyperShift PR openshift/hypershift#7824 added e2e flag plumbing for the CNCC
network service account (--e2e.gcp-network-sa). The CI step needs to extract
the SA email and pass it through.

Dependencies

Requires: GCP-431: feat: Add CNCC support for GCP WIF in HyperShift hypershift#7824 (already merged)

Jira

GCP-431

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-04-29T08:01:13Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 69da214f-9b64-4f8b-a7bc-ecf3b9a16bcf

📥 Commits

Reviewing files that changed from the base of the PR and between 8327295 and b2ac6a2.

📒 Files selected for processing (2)

ci-operator/step-registry/hypershift/gcp/hosted-cluster-setup/hypershift-gcp-hosted-cluster-setup-commands.sh
ci-operator/step-registry/hypershift/gcp/run-e2e/hypershift-gcp-run-e2e-commands.sh

Walkthrough

These changes add support for a network service account (NETWORK_SA) in the GCP HyperShift CI pipeline. The setup script extracts and validates this value from IAM/WIF output, saving it to a shared artifacts directory. The e2e test script subsequently reads and forwards this value to the e2e test command.

Changes

Cohort / File(s)	Summary
Setup Script Enhancement `ci-operator/step-registry/hypershift/gcp/hosted-cluster-setup/hypershift-gcp-hosted-cluster-setup-commands.sh`	Extracts `NETWORK_SA` identity value from IAM/WIF output, adds validation to fail early if missing, and persists it to `${SHARED_DIR}/network-sa` for downstream use.
E2E Test Script Update `ci-operator/step-registry/hypershift/gcp/run-e2e/hypershift-gcp-run-e2e-commands.sh`	Reads `NETWORK_SA` from shared directory and passes it to the e2e test via `--e2e.gcp-network-sa` command-line argument.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 12

✅ Passed checks (12 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: extracting and passing the cloud-network service account to GCP HyperShift e2e tests, which aligns with both file changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only bash shell scripts for CI/CD orchestration with no Ginkgo test definitions present.
Test Structure And Quality	✅ Passed	Pull request contains only bash shell scripts for CI/CD infrastructure, not Ginkgo test code.
Microshift Test Compatibility	✅ Passed	PR modifies bash CI/CD orchestration scripts only, not Ginkgo e2e tests. Custom check applies exclusively to new Ginkgo test definitions.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR does not add new Ginkgo e2e tests; modifications are limited to bash infrastructure setup and test invocation scripts.
Topology-Aware Scheduling Compatibility	✅ Passed	PR modifies only CI infrastructure bash scripts that extract and pass a GCP service account identifier to an e2e test binary, without introducing any Kubernetes deployment manifests, operators, or controllers with topology-aware scheduling constraints.
Ote Binary Stdout Contract	✅ Passed	OTE Binary Stdout Contract compliance check is not applicable to bash CI/CD scripts without Go test infrastructure.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR modifies only bash shell scripts for e2e test orchestration, not new Ginkgo test code with patterns like It(), Describe(), Context(), or When().

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Review rate limit: 9/10 reviews remaining, refill in 6 minutes.}

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

openshift-merge-bot · 2026-04-29T08:03:55Z

[REHEARSALNOTIFIER]
@patjlm: the pj-rehearse plugin accommodates running rehearsal tests for the changes in this PR. Expand 'Interacting with pj-rehearse' for usage details. The following rehearsable tests have been affected by this change:

Test name	Repo	Type	Reason
pull-ci-openshift-hypershift-main-e2e-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-5.1-e2e-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-5.0-e2e-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-4.23-e2e-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-4.22-e2e-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-main-e2e-v2-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-5.1-e2e-v2-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-5.0-e2e-v2-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-4.23-e2e-v2-gke	openshift/hypershift	presubmit	Registry content changed
pull-ci-openshift-hypershift-release-4.22-e2e-v2-gke	openshift/hypershift	presubmit	Registry content changed

Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals.

Interacting with pj-rehearse

Comment: /pj-rehearse to run up to 5 rehearsals
Comment: /pj-rehearse skip to opt-out of rehearsals
Comment: /pj-rehearse {test-name}, with each test separated by a space, to run one or more specific rehearsals
Comment: /pj-rehearse more to run up to 10 rehearsals
Comment: /pj-rehearse max to run up to 25 rehearsals
Comment: /pj-rehearse auto-ack to run up to 5 rehearsals, and add the rehearsals-ack label on success
Comment: /pj-rehearse list to get an up-to-date list of affected jobs
Comment: /pj-rehearse abort to abort all active rehearsals
Comment: /pj-rehearse network-access-allowed to allow rehearsals of tests that have the restrict_network_access field set to false. This must be executed by an openshift org member who is not the PR author

Once you are satisfied with the results of the rehearsals, comment: /pj-rehearse ack to unblock merge. When the rehearsals-ack label is present on your PR, merge will no longer be blocked by rehearsals.
If you would like the rehearsals-ack label removed, comment: /pj-rehearse reject to re-block merging.

apahim · 2026-04-29T08:52:31Z

/lgtm

Tests themselves will come on another PR

openshift-ci · 2026-04-29T08:53:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: apahim, patjlm

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~ci-operator/step-registry/hypershift/gcp/hosted-cluster-setup/OWNERS~~ [apahim,patjlm]
~~ci-operator/step-registry/hypershift/gcp/run-e2e/OWNERS~~ [apahim,patjlm]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

patjlm · 2026-05-04T09:36:13Z

/pj-rehearse auto-ack

openshift-merge-bot · 2026-05-04T09:36:16Z

@patjlm: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

openshift-merge-bot · 2026-05-04T09:39:51Z

@patjlm: no rehearsable tests are affected by this change

patjlm · 2026-05-04T10:33:40Z

/retest

openshift-ci · 2026-05-04T11:00:04Z

@patjlm: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Extract the cloud-network (CNCC) service account email from the IAM output and pass it to the e2e test binary via --e2e.gcp-network-sa. Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

GCP-431: feat: pass cloud-network SA to e2e tests

b2ac6a2

Extract the cloud-network (CNCC) service account email from the IAM output and pass it to the e2e test binary via --e2e.gcp-network-sa. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Apr 29, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 29, 2026

openshift-ci Bot requested review from apahim and muraee April 29, 2026 08:02

openshift-ci Bot assigned apahim Apr 29, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Apr 29, 2026

This was referenced Apr 29, 2026

OCPBUGS-78145: Pin restricted-v2 SCC on all HCP control plane pod templates openshift/hypershift#8123

Open

GCP-410: feat(gcp): add HCCO credential propagation for GCP image registry openshift/hypershift#7896

Merged

openshift-merge-bot Bot added the rehearsals-ack Signifies that rehearsal jobs have been acknowledged label May 4, 2026

openshift-merge-bot Bot merged commit 15721e7 into openshift:main May 4, 2026
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GCP-431: feat: pass cloud-network SA to GCP HyperShift e2e tests#78533

GCP-431: feat: pass cloud-network SA to GCP HyperShift e2e tests#78533
openshift-merge-bot[bot] merged 1 commit intoopenshift:mainfrom
patjlm:fix/add-network-service-account

patjlm commented Apr 29, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

openshift-ci-robot commented Apr 29, 2026 •

edited by atlassian Bot

Loading

Summary

Context

Dependencies

Jira

Uh oh!

coderabbitai Bot commented Apr 29, 2026 •

edited

Loading

Uh oh!

openshift-merge-bot Bot commented Apr 29, 2026

Uh oh!

apahim commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

patjlm commented May 4, 2026

Uh oh!

openshift-merge-bot Bot commented May 4, 2026

Uh oh!

openshift-merge-bot Bot commented May 4, 2026

Uh oh!

patjlm commented May 4, 2026

Uh oh!

openshift-ci Bot commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

patjlm commented Apr 29, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Dependencies

Jira

Summary by CodeRabbit

Release Notes

Uh oh!

openshift-ci-robot commented Apr 29, 2026 • edited by atlassian Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Dependencies

Jira

Uh oh!

coderabbitai Bot commented Apr 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

openshift-merge-bot Bot commented Apr 29, 2026

Uh oh!

apahim commented Apr 29, 2026

Uh oh!

openshift-ci Bot commented Apr 29, 2026

Uh oh!

patjlm commented May 4, 2026

Uh oh!

openshift-merge-bot Bot commented May 4, 2026

Uh oh!

openshift-merge-bot Bot commented May 4, 2026

Uh oh!

patjlm commented May 4, 2026

Uh oh!

openshift-ci Bot commented May 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

patjlm commented Apr 29, 2026 •

edited by coderabbitai Bot

Loading

openshift-ci-robot commented Apr 29, 2026 •

edited by atlassian Bot

Loading

coderabbitai Bot commented Apr 29, 2026 •

edited

Loading