CORS-4520: GCP: Add Universe Domain Support - #63
Conversation
Bring in the most up-to-date authentication packages.
go mod tidy && go mod vendor
openshift-ci-robot
added
the
jira/valid-reference
|
@patrickdillon: This pull request references CORS-4520 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: patrickdillon The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Adds support for non-default universe domains. Allows installing in Google Cloud Dedicated, GCP's sovreign cloud offering.
Replace the manual selfSignedTokenSource approach (credentials.DetectDefault + oauth2adapt) with htransport.NewClient from google.golang.org/api, which uses the SDK's internal auth handling. This ensures the HTTP client used for direct GCS REST API calls (blob reads, writes, upload sessions) gets properly authenticated tokens for non-default universe domains, matching the pattern used by gcp-pd-csi-driver and machine-api-provider-gcp. The previous approach generated self-signed JWTs with incorrect audience for GCD, causing 403 Forbidden responses from GCS. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The GCS storage driver was returning 307 redirects for blob reads, directing clients to signed URLs generated by storage.SignedURL(). In sovereign clouds (GCD), this function generates URLs pointing to storage.googleapis.com instead of the correct universe domain endpoint, causing 403 Forbidden errors when clients follow the redirect. Disable signed URL redirects for non-default universe domains by not populating the email/privateKey fields, which causes URLFor() to return ErrUnsupportedMethod and fall back to proxying content through the registry. Also refactor Reader() to use the GCS SDK client (d.gcs) instead of the raw HTTP client (d.client/getObject), matching the pattern used by GetContent() which is proven to work in sovereign clouds. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2 participants
Adds support for setting alternate universe domain in GCP. This is needed for supporting OpenShift on Google Cloud Dedicated, GCP's sovereign cloud offering.
See openshift/enhancements#1977 for more details.