OCPBUGS-77000, OCPBUGS-77013: OLM prompts for GCP Workload Identity parameters during Kiali Operato…

[cajieh]

Bug:

On GCP Workload Identity Federation (WIF) clusters, the Console incorrectly prompts users for GCP Workload Identity parameters during operator installation (e.g., Kiali Operator), even when the operator explicitly declares it does not support GCP token authentication via features.operators.openshift.io/token-auth-gcp: "false".

Root Cause: ThegetInfrastructureFeaturesfunction in operator-hub-utils.ts used inconsistent logic for GCP compared to AWS and Azure:

AWS/Azure: Checked !== 'false' (opt-out)

GCP: Only checked if cluster was GCP WIF, ignoring the annotation entirely.

Fix: Changed all three cloud providers to use opt-in logic (=== 'true') for token authentication feature detection.

The `token-auth-{xxx} Annotations behavior change from opt-out to opt-in:

Annotation Value	Before (opt-out)	After (opt-in)
'true'	Prompt shown	Prompt shown
'false'	No prompt	No prompt
Missing/undefined	Prompt shown	No prompt

Previously (opt-out): Prompts were shown by default unless explicitly disabled.
Now (opt-in): Prompts are hidden by default unless explicitly enabled.
This prevents irrelevant prompts from appearing when the feature is not supported.

Kiali Operator : token-auth-GCP="false"

Before:

After:

Regression testing

Loki Operator : token-auth-GCP="true"

It would be good to verify this change for AWS and Azure.
cc: @yapei

[openshift-ci-robot]

@cajieh: This pull request references Jira Issue OCPBUGS-77000, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

…r installation despite no GCP token-auth support

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[cajieh]

/jira refresh

[coderabbitai]

📝 Walkthrough

Walkthrough

The changes refine the TokenAuthGCP feature resolution logic in the operator hub utilities by introducing a gcpTokenAuthIsSupported flag that evaluates both the cluster type (GCP WIF) and the TokenAuthGCP annotation state. This replaces direct reliance on clusterIsGCPWIF in the feature resolution condition. The test suite is expanded with two new test cases validating that the TokenAuthGCP feature is properly excluded when the annotation is explicitly set to false, covering both standalone and legacy infrastructure feature scenarios.

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Title check	✅ Passed	The title references OCPBUGS-77000 and OCPBUGS-77013, and directly addresses the core issue: OLM incorrectly prompting for GCP WIF parameters when token-auth support is absent. This matches the changeset which adds logic to exclude TokenAuthGCP feature based on annotation state.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

• 📝 Generate docstrings (stacked PR)
• 📝 Generate docstrings (commit on current branch)

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[openshift-ci-robot]

@cajieh: An error was encountered updating to the POST state for bug OCPBUGS-77000 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message.

No response returned: Post "https://issues.redhat.com/rest/api/2/issue/17894093/transitions": POST https://issues.redhat.com/rest/api/2/issue/17894093/transitions giving up after 5 attempt(s)

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@cajieh: An error was encountered updating to the POST state for bug OCPBUGS-77000 on the Jira server at https://issues.redhat.com/. No known errors were detected, please see the full error message for details.

Full error message.

Error marking step #38842851 finished: root cause: Tried to update an entity that does not exist.: request failed. Please analyze the request body for more details. Status code: 400:

Please contact an administrator to resolve this issue, then request a bug refresh with /jira refresh.

Details

In response to this:

…r installation despite no GCP token-auth support

Summary by CodeRabbit

Release Notes

• Bug Fixes

• Improved handling of TokenAuthGCP feature resolution on GCP WIF clusters by respecting explicit annotation settings to ensure accurate feature availability.

• Tests

• Added test coverage for TokenAuthGCP feature exclusion scenarios on GCP WIF clusters.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@cajieh: This pull request references Jira Issue OCPBUGS-77000, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yapei

Details

In response to this:

Before:

After:

…r installation despite no GCP token-auth support

Summary by CodeRabbit

Release Notes

• Bug Fixes

• Improved handling of TokenAuthGCP feature resolution on GCP WIF clusters by respecting explicit annotation settings to ensure accurate feature availability.

• Tests

• Added test coverage for TokenAuthGCP feature exclusion scenarios on GCP WIF clusters.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@cajieh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@cajieh: This pull request references Jira Issue OCPBUGS-77000, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yapei

The bug has been updated to refer to the pull request using the external bug tracker.

This pull request references Jira Issue OCPBUGS-77013, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Bug:

On GCP Workload Identity Federation (WIF) clusters, the Console incorrectly prompts users for GCP Workload Identity parameters during operator installation (e.g., Kiali Operator), even when the operator explicitly declares it does not support GCP token authentication via features.operators.openshift.io/token-auth-gcp: "false".

Root Cause: The getInfrastructureFeatures function in operator-hub-utils.ts used inconsistent logic for GCP compared to AWS and Azure:

AWS/Azure: Checked !== 'false' (opt-out)

GCP: Only checked if cluster was GCP WIF, ignoring the annotation entirely.

Fix: Changed all three cloud providers to use opt-in logic (=== 'true') for token authentication feature detection.

The `token-auth-{xxx} Annotations behavior change from opt-out to opt-in:

Annotation Value	Before (opt-out)	After (opt-in)
'true'	Prompt shown	Prompt shown
'false'	No prompt	No prompt
Missing/undefined	Prompt shown	No prompt

Previously (opt-out): Prompts were shown by default unless explicitly disabled.
Now (opt-in): Prompts are hidden by default unless explicitly enabled.
This prevents irrelevant prompts from appearing when the feature is not supported.

Kiali Operator : token-auth-GCP="false"

Before:

After:

Regression testing

Loki Operator : token-auth-GCP="true"

It would be good to verify this change for AWS and Azure.
cc: @yapei

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[cajieh]

/label acknowledge-critical-fixes-only

[jhadvig]

Thank you @cajieh 👍
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: cajieh, jhadvig

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• frontend/OWNERS [cajieh,jhadvig]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[cajieh]

/verified later @yapei

[openshift-ci-robot]

@cajieh: This PR has been marked to be verified later by @yapei.

Details

In response to this:

/verified later @yapei

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[cajieh]

/jira refresh

[cajieh]

/retest

[openshift-ci-robot]

@cajieh: This pull request references Jira Issue OCPBUGS-77000, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yapei

This pull request references Jira Issue OCPBUGS-77013, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[cajieh]

/jira refresh

[openshift-ci-robot]

@cajieh: This pull request references Jira Issue OCPBUGS-77000, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yapei

This pull request references Jira Issue OCPBUGS-77013, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiazha@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@cajieh: This pull request references Jira Issue OCPBUGS-77000, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @yapei

This pull request references Jira Issue OCPBUGS-77013, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (jiazha@redhat.com), skipping review request.

Details

In response to this:

Bug:

On GCP Workload Identity Federation (WIF) clusters, the Console incorrectly prompts users for GCP Workload Identity parameters during operator installation (e.g., Kiali Operator), even when the operator explicitly declares it does not support GCP token authentication via features.operators.openshift.io/token-auth-gcp: "false".

Root Cause: ThegetInfrastructureFeaturesfunction in operator-hub-utils.ts used inconsistent logic for GCP compared to AWS and Azure:

AWS/Azure: Checked !== 'false' (opt-out)

GCP: Only checked if cluster was GCP WIF, ignoring the annotation entirely.

Fix: Changed all three cloud providers to use opt-in logic (=== 'true') for token authentication feature detection.

The `token-auth-{xxx} Annotations behavior change from opt-out to opt-in:

Annotation Value	Before (opt-out)	After (opt-in)
'true'	Prompt shown	Prompt shown
'false'	No prompt	No prompt
Missing/undefined	Prompt shown	No prompt

Previously (opt-out): Prompts were shown by default unless explicitly disabled.
Now (opt-in): Prompts are hidden by default unless explicitly enabled.
This prevents irrelevant prompts from appearing when the feature is not supported.

Kiali Operator : token-auth-GCP="false"

Before:

After:

Regression testing

Loki Operator : token-auth-GCP="true"

It would be good to verify this change for AWS and Azure.
cc: @yapei

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.