Add platform-gcp Boskos quota and secret bootstrap (1/2)

[jimdaga]

Summary

Step 1 of 2 for adding the platform-gcp cluster profile, per the cluster profile docs.

This PR adds Boskos quota slots and the secret bootstrap entry. The profile registration follows in a separate PR after secrets have synced to build clusters.

Changes

• Boskos (generate-boskos.py + regenerated _boskos.yaml): platform-gcp-quota-slice with 3 concurrent slots
• Secret bootstrap (_config.yaml): seed cluster-secrets-platform-gcp with pull-secret dockerconfigJSON

Vault secret

Self-service secret already created at selfservice/gcp-hcp-platform-ci/credentials with:

• secretsync/target-name: cluster-secrets-platform-gcp
• wif-config.json, ci-folder-id, billing-account-id

Next step

After this merges and secrets sync (~30 min), a follow-up PR will register the platform-gcp profile in cluster-profiles-config.yaml.

#82162

Jira: GCP-554

Test plan

• ci/prow/boskos-config-generation passes
• Secret syncs to build clusters after merge

🤖 Generated with Claude Code

Summary by CodeRabbit

• Adds the initial platform-gcp cluster profile infrastructure for OpenShift CI.
• Creates a three-slot platform-gcp-quota-slice Boskos quota and regenerates its configuration.
• Seeds cluster-secrets-platform-gcp with pull-secret credentials for non-application CI clusters, using the existing Vault WIF configuration and GCP identifiers.
• Defers cluster profile registration until secret synchronization is complete.

[jimdaga]

/test all

[jimdaga]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Walkthrough

Adds platform GCP CI registry credentials and configures three free platform-gcp-quota-slice Boskos resources through the generator and generated configuration.

Changes

Platform GCP infrastructure configuration

Layer / File(s)	Summary
Platform GCP CI secret bootstrap core-services/ci-secret-bootstrap/_config.yaml	Adds a cluster-secrets-platform-gcp secret mapping for non_app_ci clusters using the existing pull-secret credentials.
Platform GCP Boskos quota slice core-services/prow/02_config/generate-boskos.py, core-services/prow/02_config/_boskos.yaml	Adds platform-gcp-quota-slice with a default, minimum, and maximum count of 3 and free state configuration.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• openshift/release#82035: Updates the same secret bootstrap and Boskos configuration areas for related cloud quota slices.
• openshift/release#82102: Adds the same platform GCP secret and Boskos quota slice, with additional cluster-profile wiring.
• openshift/release#82147: Modifies the same Boskos quota-slice generation and resource configuration.

Suggested reviewers: amisstea, danilo-gemoli

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR only changes YAML/Python config; no Ginkgo test titles were added or modified.
Test Structure And Quality	✅ Passed	No Ginkgo test code changed; the PR only updates YAML/Python config for Boskos and secret bootstrap, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	No Ginkgo test files or It/Describe additions were changed; only config generation/bootstrap YAML was modified.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; the PR only changes Boskos and secret-bootstrap config, so SNO compatibility review is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR only changes Boskos/secret-bootstrap configs; no workload manifests, replicas, affinity, node selectors, or PDBs were added.
Ote Binary Stdout Contract	✅ Passed	No touched process-level code writes to stdout; generate-boskos.py only writes _boskos.yaml to a file, and the YAML-only changes have no runtime output.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No Ginkgo e2e tests were added; touched files are config-only and contain no IPv4 or external-connectivity assumptions.
No-Weak-Crypto	✅ Passed	Touched files only add Boskos quota YAML and secret-bootstrap config; no weak algorithms, custom crypto, or secret comparisons are present.
Container-Privileges	✅ Passed	Touched YAMLs only add a dockerconfigjson secret and a Boskos quota slice; no privileged, hostPID/network/IPC, SYS_ADMIN, root, or allowPrivilegeEscalation fields appear.
No-Sensitive-Data-In-Logs	✅ Passed	No new logging or print calls were added; the changes are declarative Boskos/secret mappings only, with no sensitive data emitted to logs.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: adding platform-gcp Boskos quota and secret bootstrap.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-merge-bot]

[REHEARSALNOTIFIER]
@jimdaga: no rehearsable tests are affected by this change

Note: If this PR includes changes to step registry files (ci-operator/step-registry/) and you expected jobs to be found, try rebasing your PR onto the base branch. This helps pj-rehearse accurately detect changes when the base branch has moved forward.

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@core-services/ci-secret-bootstrap/_config.yaml`:
- Around line 5425-5457: Update the pull-secret dockerconfigJSON mapping in the
ci-secret-bootstrap configuration to include the required secret type
kubernetes.io/dockerconfigjson. Preserve all existing registry entries and
cluster target settings.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: aa296309-486a-44d9-b7bd-f9cf6ee04504

📥 Commits

Reviewing files that changed from the base of the PR and between d20fcdc and 2f75728.

📒 Files selected for processing (3)

• core-services/ci-secret-bootstrap/_config.yaml
• core-services/prow/02_config/_boskos.yaml
• core-services/prow/02_config/generate-boskos.py

[openshift-ci]

@jimdaga: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jimdaga]

/pj-rehearse ack

[openshift-merge-bot]

@jimdaga: now processing your pj-rehearse request. Please allow up to 10 minutes for jobs to trigger or cancel.

[danilo-gemoli]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: danilo-gemoli, jimdaga

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• core-services/ci-secret-bootstrap/OWNERS [danilo-gemoli]
• core-services/prow/02_config/OWNERS [danilo-gemoli]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jimdaga: Updated the following 3 configmaps:

• ci-secret-bootstrap configmap in namespace ci at cluster app.ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• ci-secret-bootstrap configmap in namespace ci at cluster core-ci using the following files:
  • key _config.yaml using file core-services/ci-secret-bootstrap/_config.yaml
• resources configmap in namespace ci at cluster app.ci using the following files:
  • key boskos.yaml using file core-services/prow/02_config/_boskos.yaml

Details

In response to this:

Summary

Step 1 of 2 for adding the platform-gcp cluster profile, per the cluster profile docs.

This PR adds Boskos quota slots and the secret bootstrap entry. The profile registration follows in a separate PR after secrets have synced to build clusters.

Changes

• Boskos (generate-boskos.py + regenerated _boskos.yaml): platform-gcp-quota-slice with 3 concurrent slots
• Secret bootstrap (_config.yaml): seed cluster-secrets-platform-gcp with pull-secret dockerconfigJSON

Vault secret

Self-service secret already created at selfservice/gcp-hcp-platform-ci/credentials with:

• secretsync/target-name: cluster-secrets-platform-gcp
• wif-config.json, ci-folder-id, billing-account-id

Next step

After this merges and secrets sync (~30 min), a follow-up PR will register the platform-gcp profile in cluster-profiles-config.yaml.

#82162

Jira: GCP-554

Test plan

• ci/prow/boskos-config-generation passes
• Secret syncs to build clusters after merge

🤖 Generated with Claude Code

Summary by CodeRabbit

• Adds the initial platform-gcp cluster profile infrastructure for OpenShift CI.
• Creates a three-slot platform-gcp-quota-slice Boskos quota and regenerates its configuration.
• Seeds cluster-secrets-platform-gcp with pull-secret credentials for non-application CI clusters, using the existing Vault WIF configuration and GCP identifiers.
• Defers cluster profile registration until secret synchronization is complete.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.