CORS-4508: Add e2e-gcd installer CI job for Google Cloud Dedicated

ci-operator/config/openshift/installer/openshift-installer-main.yaml

@@ -530,6 +530,21 @@ tests:
       FEATURE_SET: TechPreviewNoUpgrade
       OS_IMAGE_STREAM: rhel-10
     workflow: openshift-e2e-aws
+- always_run: false
+  as: e2e-gcd-techpreview
+  cluster: build07
+  optional: true
+  steps:
+    cluster_profile: gcd
+    env:
+      AWS_PROFILE: hub
+      BASE_DOMAIN: ci.gcd.devcluster.openshift.com
+      COMPUTE_NODE_REPLICAS: "2"
+      DEFAULT_MACHINE_OSIMAGE: rhcos10
+      FEATURE_SET: TechPreviewNoUpgrade
+      GOOGLE_CLOUD_UNIVERSE_DOMAIN: apis-berlin-build0.goog
+      PUBLISH: Internal
+    workflow: openshift-e2e-gcd
 - as: e2e-gcp-ovn
   run_if_changed: (gcp|google)
   steps:

ci-operator/jobs/openshift/installer/openshift-installer-main-presubmits.yaml

@@ -5803,6 +5803,96 @@ presubmits:
         secret:
           secretName: result-aggregator
     trigger: (?m)^/test( | .* )e2e-external-aws-ccm,?($|\s.*)
+  - agent: kubernetes
+    always_run: false
+    branches:
+    - ^main$
+    - ^main-
+    cluster: build07
+    context: ci/prow/e2e-gcd-techpreview
+    decorate: true
+    decoration_config:
+      sparse_checkout_files:
+      - .ci-operator.yaml
+      - images/baremetal/Dockerfile.ci
+      - images/installer/Dockerfile.ci
+      - images/installer/Dockerfile.upi.ci
+      - images/libvirt/Dockerfile.ci
+      - images/openstack/Dockerfile.ci
+    labels:
+      ci-operator.openshift.io/cloud: gcp
+      ci-operator.openshift.io/cloud-cluster-profile: gcd
+      ci-operator.openshift.io/cluster: build07
+      ci.openshift.io/generator: prowgen
+      pj-rehearse.openshift.io/can-be-rehearsed: "true"
+    name: pull-ci-openshift-installer-main-e2e-gcd-techpreview
+    optional: true
+    rerun_command: /test e2e-gcd-techpreview
+    spec:
+      containers:
+      - args:
+        - --gcs-upload-secret=/secrets/gcs/service-account.json
+        - --image-import-pull-secret=/etc/pull-secret/.dockerconfigjson
+        - --lease-server-credentials-file=/etc/boskos/credentials
+        - --report-credentials-file=/etc/report/credentials
+        - --secret-dir=/secrets/ci-pull-credentials
+        - --target=e2e-gcd-techpreview
+        command:
+        - ci-operator
+        env:
+        - name: HTTP_SERVER_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        image: quay-proxy.ci.openshift.org/openshift/ci:ci_ci-operator_latest
+        imagePullPolicy: Always
+        name: ""
+        ports:
+        - containerPort: 8080
+          name: http
+        resources:
+          requests:
+            cpu: 10m
+        volumeMounts:
+        - mountPath: /etc/boskos
+          name: boskos
+          readOnly: true
+        - mountPath: /secrets/ci-pull-credentials
+          name: ci-pull-credentials
+          readOnly: true
+        - mountPath: /secrets/gcs
+          name: gcs-credentials
+          readOnly: true
+        - mountPath: /secrets/manifest-tool
+          name: manifest-tool-local-pusher
+          readOnly: true
+        - mountPath: /etc/pull-secret
+          name: pull-secret
+          readOnly: true
+        - mountPath: /etc/report
+          name: result-aggregator
+          readOnly: true
+      serviceAccountName: ci-operator
+      volumes:
+      - name: boskos
+        secret:
+          items:
+          - key: credentials
+            path: credentials
+          secretName: boskos-credentials
+      - name: ci-pull-credentials
+        secret:
+          secretName: ci-pull-credentials
+      - name: manifest-tool-local-pusher
+        secret:
+          secretName: manifest-tool-local-pusher
+      - name: pull-secret
+        secret:
+          secretName: registry-pull-credentials
+      - name: result-aggregator
+        secret:
+          secretName: result-aggregator
+    trigger: (?m)^/test( | .* )e2e-gcd-techpreview,?($|\s.*)
   - agent: kubernetes
     always_run: false
     branches:

ci-operator/step-registry/gather/gcp-console/gather-gcp-console-commands.sh

@@ -7,7 +7,11 @@ set -o pipefail
 trap 'CHILDREN=$(jobs -p); if test -n "${CHILDREN}"; then kill ${CHILDREN} && wait; fi' TERM
 
 export GOOGLE_CLOUD_KEYFILE_JSON="${CLUSTER_PROFILE_DIR}/gce.json"
-gcloud auth activate-service-account --key-file="${GOOGLE_CLOUD_KEYFILE_JSON}"
+if [[ "$(jq -r .type ${GOOGLE_CLOUD_KEYFILE_JSON} 2>/dev/null)" == "external_account" ]]; then
+  gcloud auth login --cred-file="${GOOGLE_CLOUD_KEYFILE_JSON}" --quiet
+else
+  gcloud auth activate-service-account --key-file="${GOOGLE_CLOUD_KEYFILE_JSON}"
+fi
 
 if test ! -f "${SHARED_DIR}/metadata.json"
 then

ci-operator/step-registry/gcp/deprovision/bastionhost/gcp-deprovision-bastionhost-commands.sh

@@ -25,11 +25,17 @@ if [[ "${OSD_QE_PROJECT_AS_SERVICE_PROJECT}" == "yes" ]]; then
 else
   GOOGLE_PROJECT_ID="$(< ${CLUSTER_PROFILE_DIR}/openshift_gcp_project)"
   export GCP_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/gce.json"
-  sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
-  if ! gcloud auth list | grep -E "\*\s+${sa_email}"
-  then
-    gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+  CRED_TYPE=$(jq -r .type "${GCP_SHARED_CREDENTIALS_FILE}" 2>/dev/null)
+  if [[ "${CRED_TYPE}" == "external_account" ]]; then
+    gcloud auth login --cred-file="${GCP_SHARED_CREDENTIALS_FILE}" --quiet
     gcloud config set project "${GOOGLE_PROJECT_ID}"
+  else
+    sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
+    if ! gcloud auth list | grep -E "\*\s+${sa_email}"
+    then
+      gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+      gcloud config set project "${GOOGLE_PROJECT_ID}"
+    fi
   fi
 fi
 

ci-operator/step-registry/gcp/deprovision/vpc/gcp-deprovision-vpc-commands.sh

@@ -14,11 +14,17 @@ fi
 GOOGLE_PROJECT_ID="$(< ${CLUSTER_PROFILE_DIR}/openshift_gcp_project)"
 
 export GCP_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/gce.json"
-sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
-if ! gcloud auth list | grep -E "\*\s+${sa_email}"
-then
-  gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+CRED_TYPE=$(jq -r .type "${GCP_SHARED_CREDENTIALS_FILE}" 2>/dev/null)
+if [[ "${CRED_TYPE}" == "external_account" ]]; then
+  gcloud auth login --cred-file="${GCP_SHARED_CREDENTIALS_FILE}" --quiet
   gcloud config set project "${GOOGLE_PROJECT_ID}"
+else
+  sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
+  if ! gcloud auth list | grep -E "\*\s+${sa_email}"
+  then
+    gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+    gcloud config set project "${GOOGLE_PROJECT_ID}"
+  fi
 fi
 
 ## Destroy the VPC

ci-operator/step-registry/gcp/provision/bastionhost/gcp-provision-bastionhost-commands.sh

@@ -65,8 +65,8 @@ workdir=`mktemp -d`
 # Generally we do not update boot image for bastion host very often, we just use it as a jump
 # host, mirror registry, and proxy server, these services do not have frequent update.
 # So hard-code them here.
-IMAGE_NAME="fedora-coreos-41-20241122-3-0-gcp-x86-64"
-IMAGE_PROJECT="fedora-coreos-cloud"
+IMAGE_NAME="${BASTION_IMAGE_NAME:-fedora-coreos-41-20241122-3-0-gcp-x86-64}"
+IMAGE_PROJECT="${BASTION_IMAGE_PROJECT:-fedora-coreos-cloud}"
 echo "Using ${IMAGE_NAME} image from ${IMAGE_PROJECT} project"
 
 #####################################
@@ -88,19 +88,25 @@ if [[ "${OSD_QE_PROJECT_AS_SERVICE_PROJECT}" == "yes" ]]; then
 else
   GOOGLE_PROJECT_ID="$(< ${CLUSTER_PROFILE_DIR}/openshift_gcp_project)"
   export GCP_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/gce.json"
-  sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
-  if ! gcloud auth list | grep -E "\*\s+${sa_email}"
-  then
-    gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+  CRED_TYPE=$(jq -r .type "${GCP_SHARED_CREDENTIALS_FILE}" 2>/dev/null)
+  if [[ "${CRED_TYPE}" == "external_account" ]]; then
+    gcloud auth login --cred-file="${GCP_SHARED_CREDENTIALS_FILE}" --quiet
     gcloud config set project "${GOOGLE_PROJECT_ID}"
+  else
+    sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
+    if ! gcloud auth list | grep -E "\*\s+${sa_email}"
+    then
+      gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+      gcloud config set project "${GOOGLE_PROJECT_ID}"
+    fi
   fi
 fi
 
 REGION="${LEASED_RESOURCE}"
 echo "Using region: ${REGION}"
 
 ZONE_0=$(gcloud compute regions describe ${REGION} --format=json | jq -r .zones[0] | cut -d "/" -f9)
-MACHINE_TYPE="n2-standard-2"
+MACHINE_TYPE="${BASTION_MACHINE_TYPE:-n2-standard-2}"
 
 #####################################
 ##########Create Bastion#############

ci-operator/step-registry/gcp/provision/bastionhost/gcp-provision-bastionhost-ref.yaml

@@ -29,5 +29,20 @@ ref:
   - name: OSD_QE_PROJECT_AS_SERVICE_PROJECT
     default: "no"
     documentation: Whether to use OSD QE's project as the service project. The supported values are [no, yes].
+  - name: BASTION_MACHINE_TYPE
+    default: ""
+    documentation: |-
+      The GCP machine type for the bastion host. If empty, defaults to
+      n2-standard-2.
+  - name: BASTION_IMAGE_NAME
+    default: ""
+    documentation: |-
+      The GCP image name for the bastion host. If empty, defaults to a
+      Fedora CoreOS image.
+  - name: BASTION_IMAGE_PROJECT
+    default: ""
+    documentation: |-
+      The GCP project hosting the bastion image. If empty, defaults to
+      fedora-coreos-cloud.
   documentation: |-
     The step launches Linux bastion host within the CONTROL_PLANE_SUBNET.

ci-operator/step-registry/gcp/provision/vpc/gcp-provision-vpc-commands.sh

@@ -73,11 +73,17 @@ EOF
 
 GOOGLE_PROJECT_ID="$(< ${CLUSTER_PROFILE_DIR}/openshift_gcp_project)"
 export GCP_SHARED_CREDENTIALS_FILE="${CLUSTER_PROFILE_DIR}/gce.json"
-sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
-if ! gcloud auth list | grep -E "\*\s+${sa_email}"
-then
-  gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+CRED_TYPE=$(jq -r .type "${GCP_SHARED_CREDENTIALS_FILE}" 2>/dev/null)
+if [[ "${CRED_TYPE}" == "external_account" ]]; then
+  gcloud auth login --cred-file="${GCP_SHARED_CREDENTIALS_FILE}" --quiet
   gcloud config set project "${GOOGLE_PROJECT_ID}"
+else
+  sa_email=$(jq -r .client_email ${GCP_SHARED_CREDENTIALS_FILE})
+  if ! gcloud auth list | grep -E "\*\s+${sa_email}"
+  then
+    gcloud auth activate-service-account --key-file="${GCP_SHARED_CREDENTIALS_FILE}"
+    gcloud config set project "${GOOGLE_PROJECT_ID}"
+  fi
 fi
 
 echo "$(date -u --rfc-3339=seconds) - Copying resource files from lib dir..."

ci-operator/step-registry/ipi/conf/gcd/OWNERS

@@ -0,0 +1,5 @@
+approvers:
+- barbacbd
+- patrickdillon
+- rochacbruno
+- tthvo