feat(gcp): add GCP PSC conditions to metrics and credential gauge

[apahim]

Summary

• Add GCPEndpointAvailable and GCPServiceAttachmentAvailable to ExpectedHCConditions() so PSC failures surface in hypershift_hostedclusters_failure_conditions
• Track GCP PSC conditions in the hypershift_hosted_cluster_transition_seconds histogram for latency visibility
• Add hypershift_cluster_invalid_gcp_creds gauge metric (0=valid, 1=invalid, 2=unknown) mirroring the AWS credential gauge pattern
• Add GetCredentialStatus() tri-state function to the GCP platform package

Test plan

• TestGetCredentialStatus — 8 cases covering valid/invalid/unknown/missing combinations
• TestReportInvalidGcpCreds — 7 cases validating gauge metric values
• TestReportTransitionDurationForGCPEndpointConditions — 5 cases validating histogram observations
• All existing tests pass with no regressions

Refs: GCP-959

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features
  • Added monitoring for GCP credential status, including valid, invalid, and unknown states.
  • Added GCP endpoint and service attachment availability to transition-duration metrics.
• Bug Fixes
  • GCP hosted clusters now correctly report endpoint and service attachment availability conditions.
• Tests
  • Added coverage for GCP credential status, availability metrics, and expected platform conditions.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e66d2396-466d-4299-acfe-b23929310a64

📥 Commits

Reviewing files that changed from the base of the PR and between 3bdedcf and bb55bbc.

📒 Files selected for processing (3)

• hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go
• hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go
• support/conditions/conditions_test.go

🚧 Files skipped from review as they are similar to previous changes (2)

• hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go
• hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go

---

📝 Walkthrough

Walkthrough

The change adds aggregate GCP credential status evaluation for Workload Identity and credential conditions. It publishes valid, invalid, and unknown states through HostedCluster Prometheus metrics. GCP endpoint and service-attachment conditions now participate in transition-duration metrics. Expected GCP conditions and related tests are updated.

Sequence Diagram(s)

sequenceDiagram
  participant HostedCluster
  participant GCPPlatform
  participant HostedClusterMetrics
  participant Prometheus
  HostedCluster->>GCPPlatform: provide credential conditions
  GCPPlatform-->>HostedClusterMetrics: return credential status
  HostedClusterMetrics->>Prometheus: publish credential-status gauge

Loading

Possibly related PRs

• openshift/hypershift#9242: Implements related GCP credential-status, PSC condition, metrics, expected-condition, and test changes.

Suggested reviewers: csrwng, jparrill

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: GCP PSC condition metrics and the credential status gauge.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Affected tests use static Test names and literal table-case names via t.Run; no Ginkgo It/Describe/Context/When/Entry titles or dynamic title construction were found.
Test Structure And Quality	✅ Passed	The changed tests use Go testing with t.Run, not Ginkgo. They use fake clients only, create no cluster resources, and contain no Eventually or Consistently waits.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR changes credential metrics, condition logic, and tests only. The full diff adds no affinity, topology spread, selectors, tolerations, replica, or PDB scheduling constraints.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The changed files add or modify standard Go unit tests only; no Ginkgo It, Describe, Context, or When tests, IPv4 assumptions, or external network access were found.
No-Weak-Crypto	✅ Passed	The complete PR diff adds only condition aggregation and Prometheus metric logic; it contains no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
Container-Privileges	✅ Passed	The isolated feature diff changes six Go files, adds no manifest-like files or privilege settings; GCP security-context matches are pre-existing lines outside the added code.
No-Sensitive-Data-In-Logs	✅ Passed	The PR adds no logging calls or sensitive-data dumps; the patch only derives credential status and emits a metric using the existing namespace/name/_id label schema.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: apahim
Once this PR has been reviewed and has the lgtm label, please assign csrwng for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

🧹 Nitpick comments (1)

hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go (1)

138-195: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use the required test-case description format.

Update each new case description to use When ... it should ....

• hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go#L138-L195: Add it should to each credential-status case description.
• hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go#L656-L695: Add it should to each GCP credential metric case description.
• hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go#L1607-L1609: Change the no-condition case description to use the required format.

As per coding guidelines, unit-test case descriptions must use the "When ... it should ..." format.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go`
around lines 138 - 195, Update the test case descriptions in
hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go:138-195
and
hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go:656-695 so
every GCP credential-status case uses the “When ... it should ...” format; also
update the no-condition case in
hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go:1607-1609
to follow the same format. Modify only the descriptions, preserving each test’s
behavior and expectations.

Source: Coding guidelines

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go`:
- Around line 138-195: Update the test case descriptions in
hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go:138-195
and
hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go:656-695 so
every GCP credential-status case uses the “When ... it should ...” format; also
update the no-condition case in
hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go:1607-1609
to follow the same format. Modify only the descriptions, preserving each test’s
behavior and expectations.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 43ad4be0-2bde-45be-8fc9-01bb9e758a52

📥 Commits

Reviewing files that changed from the base of the PR and between 54dfce9 and 3bdedcf.

📒 Files selected for processing (5)

• hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp.go
• hypershift-operator/controllers/hostedcluster/internal/platform/gcp/gcp_conditions_test.go
• hypershift-operator/controllers/hostedcluster/metrics/metrics.go
• hypershift-operator/controllers/hostedcluster/metrics/metrics_test.go
• support/conditions/conditions.go

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 45.05%. Comparing base (60ada1e) to head (bb55bbc).
⚠️ Report is 90 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9250      +/-   ##
==========================================
+ Coverage   44.81%   45.05%   +0.23%     
==========================================
  Files         775      778       +3     
  Lines       97219    97532     +313     
==========================================
+ Hits        43572    43945     +373     
+ Misses      50644    50556      -88     
- Partials     3003     3031      +28     

Files with missing lines	Coverage Δ
...rollers/hostedcluster/internal/platform/gcp/gcp.go	84.67% <100.00%> (+1.00%)	⬆️
...rator/controllers/hostedcluster/metrics/metrics.go	93.20% <100.00%> (+0.17%)	⬆️
support/conditions/conditions.go	39.09% <100.00%> (+39.09%)	⬆️

... and 35 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	38.81% <100.00%> (+0.38%)	⬆️
cpo-hostedcontrolplane	47.24% <ø> (-0.08%)	⬇️
cpo-other	45.79% <ø> (+0.12%)	⬆️
hypershift-operator	55.06% <100.00%> (+0.42%)	⬆️
other	34.32% <ø> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@apahim: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.