CORS-4521: GCP: Add regional permission

[patrickdillon]

Adds a permission necessary for deploying in Google Dedicated Cloud environments, which are regional--not global.

Summary by CodeRabbit

• Bug Fixes
  • Added the required read-only permission for accessing regional compute health checks during credential requests.

[openshift-ci-robot]

@patrickdillon: This pull request references CORS-4521 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Adds a permission necessary for deploying in Google Dedicated Cloud environments, which are regional--not global.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: af46b811-a2b0-4ae5-94d0-c4c57ac043ae

📥 Commits

Reviewing files that changed from the base of the PR and between 417ad2f and 7cce761.

📒 Files selected for processing (1)

• install/0000_30_machine-api-operator_00_credentials-request.yaml

---

Walkthrough

The GCP CredentialsRequest permission list adds compute.regionHealthChecks.useReadOnly to the Machine API Operator manifest.

Changes

GCP credentials permissions

Layer / File(s)	Summary
Add regional health check permission install/0000_30_machine-api-operator_00_credentials-request.yaml	The GCP CredentialsRequest adds compute.regionHealthChecks.useReadOnly to its provider permissions.

Estimated code review effort: 1 (Trivial) | ~2 minutes

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the change: adding a GCP regional permission for Dedicated Cloud deployments.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only a YAML credentials manifest changed; no Ginkgo test files or titles were modified.
Test Structure And Quality	✅ Passed	No Ginkgo test files or test logic were changed; the PR only updates a manifest permission, so this check is not applicable.
Microshift Test Compatibility	✅ Passed	Only a manifest permission was added; no new Ginkgo tests or MicroShift-unsupported APIs/features were introduced.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	Only a YAML IAM permission changed; no new Ginkgo tests or SNO-relevant code were added.
Topology-Aware Scheduling Compatibility	✅ Passed	Only a GCP CredentialsRequest permission was added; no replicas, affinity, nodeSelector, tolerations, or spread constraints changed.
Ote Binary Stdout Contract	✅ Passed	PR only adds a YAML IAM permission in a manifest; no main/init/suite code or stdout logging changes were introduced.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PR only updates a YAML CredentialsRequest permission; no new Ginkgo e2e tests or network assumptions were added.
No-Weak-Crypto	✅ Passed	Patch only adds GCP permission compute.regionHealthChecks.useReadOnly; no weak crypto, custom crypto, or secret comparison code is introduced.
Container-Privileges	✅ Passed	The only change adds a GCP IAM permission in a CredentialsRequest; no privileged, hostPID/Network/IPC, root, or allowPrivilegeEscalation fields were introduced.
No-Sensitive-Data-In-Logs	✅ Passed	Only a GCP permission was added in a manifest; no logging code or sensitive-data strings were introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[theobarberbany]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: theobarberbany

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [theobarberbany]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[barbacbd]

/label acknowledge-critical-fixes-only

[patrickdillon]

/test e2e-gcp-ovn

[openshift-ci]

@patrickdillon: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ipi-ovn-ipv6	7cce761	link	true	/test e2e-metal-ipi-ovn-ipv6
ci/prow/e2e-aws-ovn	7cce761	link	true	/test e2e-aws-ovn
ci/prow/e2e-gcp-ovn	7cce761	link	false	/test e2e-gcp-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.