From 771753e9bf10052f4e83fe82aa88c620317bc968 Mon Sep 17 00:00:00 2001 From: Andrew McDermott Date: Tue, 15 Sep 2026 15:29:54 +0100 Subject: [PATCH] Pin bgp-cloud-connector's e2e-gcp-operator to the gcp profile The job builds a Network Connectivity Center hub as a test prerequisite, and only one of the three projects behind openshift-org-gcp lets the cluster-profile account create one. Measured with testIamPermissions on 2026-09-15: in openshift-gce-devel-ci-3 the account holds thirteen of the fifteen permissions the estate needs and is denied networkconnectivity.hubs.create and networkconnectivity.hubs.delete. It can list hubs and spokes, so the denial is narrow rather than a missing NCC role. Which project a run gets is whichever quota slice is free, so the job fails about four times in five for a reason that has nothing to do with the code under review, and a green run proves only that the lease was lucky. Pinning to gcp makes it deterministic. That profile carries its own lease pool of 365 slices, marginally larger than openshift-org-gcp's 355, so this costs no capacity. The set rule needs an exception for the pin to validate, which is what the cluster-profiles entry is for. It is scoped to this one test rather than to the repository. Granting those two permissions across all three projects would be the better fix and would let this be reverted; the request is in openshift/bgp-cloud-connector#124. --- .../openshift-bgp-cloud-connector-main.yaml | 2 +- .../openshift-bgp-cloud-connector-main-presubmits.yaml | 2 +- .../cluster-profiles/cluster-profiles-config.yaml | 4 ++++ 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/ci-operator/config/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main.yaml b/ci-operator/config/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main.yaml index c0ac883cc2008..daaef7ffefe81 100644 --- a/ci-operator/config/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main.yaml +++ b/ci-operator/config/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main.yaml @@ -299,7 +299,7 @@ tests: as: e2e-gcp-operator optional: true steps: - cluster_profile: openshift-org-gcp + cluster_profile: gcp env: COMPUTE_NODE_TYPE: n2-standard-4 test: diff --git a/ci-operator/jobs/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main-presubmits.yaml b/ci-operator/jobs/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main-presubmits.yaml index 9f53af9205d01..080eeece239db 100644 --- a/ci-operator/jobs/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main-presubmits.yaml +++ b/ci-operator/jobs/openshift/bgp-cloud-connector/openshift-bgp-cloud-connector-main-presubmits.yaml @@ -449,7 +449,7 @@ presubmits: - Dockerfile labels: ci-operator.openshift.io/cloud: gcp - ci-operator.openshift.io/cloud-cluster-profile: openshift-org-gcp + ci-operator.openshift.io/cloud-cluster-profile: gcp ci.openshift.io/generator: prowgen pj-rehearse.openshift.io/can-be-rehearsed: "true" name: pull-ci-openshift-bgp-cloud-connector-main-e2e-gcp-operator diff --git a/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml b/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml index c72f06ea76f7e..b6ddbba837cce 100644 --- a/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml +++ b/ci-operator/step-registry/cluster-profiles/cluster-profiles-config.yaml @@ -8,6 +8,10 @@ cluster_profile_sets_config: .+: .*: - .+-public-ipv4-pool.* + openshift/bgp-cloud-connector: + .+: + .*: + - e2e-gcp-operator openshift/release: .+: .*: