Conversation
The job builds a Network Connectivity Center hub as a test prerequisite, and only one of the three projects behind openshift-org-gcp lets the cluster-profile account create one. Measured with testIamPermissions on 2026-09-15: in openshift-gce-devel-ci-3 the account holds thirteen of the fifteen permissions the estate needs and is denied networkconnectivity.hubs.create and networkconnectivity.hubs.delete. It can list hubs and spokes, so the denial is narrow rather than a missing NCC role. Which project a run gets is whichever quota slice is free, so the job fails about four times in five for a reason that has nothing to do with the code under review, and a green run proves only that the lease was lucky. Pinning to gcp makes it deterministic. That profile carries its own lease pool of 365 slices, marginally larger than openshift-org-gcp's 355, so this costs no capacity. The set rule needs an exception for the pin to validate, which is what the cluster-profiles entry is for. It is scoped to this one test rather than to the repository. Granting those two permissions across all three projects would be the better fix and would let this be reverted; the request is in openshift/bgp-cloud-connector#124.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Central YAML (inherited) Review profile: CHILL Plan: Enterprise Run ID: ⛔ Files ignored due to path filters (1)
📒 Files selected for processing (2)
Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review. WalkthroughThe GCP operator test now uses the ChangesGCP profile update
Priority: ⬇️ Low Estimated code review effort: 1 (Trivial) | ~5 minutes Change: Bug fix Suggested reviewers: Merge Risk: ⚪ Minimal · up to The presubmit configuration now consistently selects the dedicated GCP quota-slice profile for the affected test, with no identified merge-blocking risk. 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: frobware The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
[REHEARSALNOTIFIER]
Prior to this PR being merged, you will need to either run and acknowledge or opt to skip these rehearsals. Interacting with pj-rehearseComment: Once you are satisfied with the results of the rehearsals, comment: |
|
@frobware: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/assign bear-redhat |
2 participants
e2e-gcp-operatoron openshift/bgp-cloud-connector builds a Network Connectivity Center hub as a test prerequisite, because the operator under test attaches a router appliance spoke to it. Theopenshift-org-gcpcluster-profile account cannot create one in two of the three projects that profile leases from, so the job fails for a reason unrelated to the code under review and a green run means only that the lease was lucky.All three projects are now sampled, with
testIamPermissionson the project rather than inferred from whichever call failed first. In both denied projects the account holds thirteen of the fifteen permissions the estate needs and is denied exactlynetworkconnectivity.hubs.createandnetworkconnectivity.hubs.delete. It can list hubs and spokes, so the gap is narrow rather than a missing NCC role.gcpopenshift-gce-devel-cigcp-openshift-gce-devel-ci-2openshift-gce-devel-ci-2gcp-3openshift-gce-devel-ci-3The one that works does so by accident, not by design: its provisioner is
do-not-delete-ci-provisioner, which holdsroles/admin. No project grants these permissions deliberately. Note also that the account names differ per project --ci-provisioner,ci-provisioner-2,ci-provisioner-- so a grant needs the right principal rather than a pattern.I would rather you did the grant than merged this. Adding
networkconnectivity.hubs.createandnetworkconnectivity.hubs.deleteto the cluster-profile account in all three projects fixes the job wherever it lands and lets this PR be reverted.roles/networkconnectivity.hubAdmincovers both but carries 54 permissions, so a custom role with just the two is narrower. Delete matters as much as create: without it a failed run leaks a hub into a shared project.Failing that, this pins the job to
gcp, the only project where it currently works. That profile has its own lease pool of 365 slices againstopenshift-org-gcp's 355, so it costs no capacity. The set rule needs an exception for the pin to validate, which is what thecluster-profiles-config.yamlentry is for; it is scoped to this one test, not the repository.Background and full logs: openshift/bgp-cloud-connector#124 (comment)
Test plan
make ci-operator-checkconfigpasses with the exception and fails without it, withinvalid cluster profile "gcp", use the cluster profile set "openshift-org-gcp" instead. The presubmit was regenerated withmake ci-operator-prowgen WHAT="--org openshift --repo bgp-cloud-connector"; the only change is thecloud-cluster-profilelabel. A rehearsal is not meaningful yet:hack/ci-e2e-gcp.shdoes not exist on that repo'smainuntil openshift/bgp-cloud-connector#136 merges, so a rehearsal today would fail on a missing script rather than test the pin.e2e-gcp-operatorisoptional: trueand not gating.