Bug 1871030

Summary: Restricting Resource Locations blocks Openshift installer progress in Google Cloud Platform due to policies.
Product: OpenShift Container Platform Reporter: David Hernández Fernández <dahernan>
Component: InstallerAssignee: John Hixson <jhixson>
Installer sub component: openshift-installer QA Contact: To Hung Sze <tsze>
Status: CLOSED ERRATA Docs Contact:
Severity: high    
Priority: high CC: adahiya, daniel.kucera, tsze, yanyang
Version: 4.5   
Target Milestone: ---   
Target Release: 4.6.0   
Hardware: All   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: Assumption of 'US' as default location Consequence: Failure to install in some regions outside of 'US' Fix: Specify location based on region used Result: Install is successful
 Story Points: ---
Clone Of: Environment:
Last Closed: 2020-10-27 16:30:14 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1891168    

Description David Hernández Fernández 2020-08-21 07:43:14 UTC 
Description of problem:  Restricting Resource Locations blocks Openshift installer progress in Google Cloud Platform due to restriction policies of instances based on the documentation.

Steps to Reproduce:
1. Configure 'Restricting Resource Locations' https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations#gcloud
2. Install Opensihft on Google Cloud Platform

Actual results:
ERROR
ERROR Error: Error creating Image: googleapi: Error 412: Location us violates constraint constraints/gcp.resourceLocations on the resource projects/dbg-energy-poc/global/images/ocp-lkbh5-rhcos-image., conditionNotMet
ERROR
ERROR   on ../../../../tmp/openshift-install-163350623/main.tf line 93, in resource "google_compute_image" "cluster":
ERROR   93: resource "google_compute_image" "cluster" {
ERROR
ERROR
ERROR
ERROR Error: googleapi: Error 412: 'us' violates constraint 'constraints/gcp.resourceLocations', conditionNotMet
ERROR
ERROR   on ../../../../tmp/openshift-install-163350623/bootstrap/main.tf line 1, in resource "google_storage_bucket" "ignition":
ERROR    1: resource "google_storage_bucket" "ignition" {
ERROR
ERROR

This is because 'US' is default in terraform values for 'location':
https://www.terraform.io/docs/providers/google/r/storage_bucket.html#location

Expected results: To be able to install Openshift without disabling the policies.

Additional info: Will be uploading install-config and more logs.
Comment 10 To Hung Sze 2020-09-03 20:06:26 UTC 
David, could you please refer to below from our project admin on the specific settings your customer is using so that we can get ours set up properly:
It seems that this feature must be configured by GCP Super Admins, and we don't have that permission. Please give details about how you want the permissions configured, and we can pass that to the GCP Super Admins to configure it. We probably want to create a new project just for this, so that the restrictions only apply to that project.

Thanks.
Comment 11 David Hernández Fernández 2020-09-14 07:46:44 UTC 
Hi @tsze
Sorry for the late reply, this is already confirmed to be working by the customer even with nightly builds after PR merged: https://github.com/openshift/installer/pull/4089

The configuration can be tested by selecting and configuring any restriction as per official Google Cloud docs: https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations#gcloud
Comment 12 To Hung Sze 2020-09-22 02:14:47 UTC 
Thank you. David. I will close this one.
Comment 13 David Hernández Fernández 2020-09-25 10:08:11 UTC 
Thank you for the quick resolution.
Comment 16 errata-xmlrpc 2020-10-27 16:30:14 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:4196