Bug 1871030 - Restricting Resource Locations blocks Openshift installer progress in Google Cloud Platform due to policies.
Summary: Restricting Resource Locations blocks Openshift installer progress in Google ...
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Installer
Version: 4.5
Hardware: All
OS: Unspecified
Target Milestone: ---
: 4.6.0
Assignee: John Hixson
QA Contact: To Hung Sze
Depends On:
Blocks: 1891168
TreeView+ depends on / blocked
Reported: 2020-08-21 07:43 UTC by David Hernández Fernández
Modified: 2023-12-15 18:57 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: Assumption of 'US' as default location Consequence: Failure to install in some regions outside of 'US' Fix: Specify location based on region used Result: Install is successful
Clone Of:
Last Closed: 2020-10-27 16:30:14 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift installer pull 4089 0 None closed bug 1871030: data/data/gcp: be pedantic about setting the region 2021-02-16 10:57:17 UTC
Red Hat Product Errata RHBA-2020:4196 0 None None None 2020-10-27 16:30:28 UTC

Description David Hernández Fernández 2020-08-21 07:43:14 UTC
Description of problem:  Restricting Resource Locations blocks Openshift installer progress in Google Cloud Platform due to restriction policies of instances based on the documentation.

Steps to Reproduce:
1. Configure 'Restricting Resource Locations' https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations#gcloud
2. Install Opensihft on Google Cloud Platform

Actual results:
ERROR Error: Error creating Image: googleapi: Error 412: Location us violates constraint constraints/gcp.resourceLocations on the resource projects/dbg-energy-poc/global/images/ocp-lkbh5-rhcos-image., conditionNotMet
ERROR   on ../../../../tmp/openshift-install-163350623/main.tf line 93, in resource "google_compute_image" "cluster":
ERROR   93: resource "google_compute_image" "cluster" {
ERROR Error: googleapi: Error 412: 'us' violates constraint 'constraints/gcp.resourceLocations', conditionNotMet
ERROR   on ../../../../tmp/openshift-install-163350623/bootstrap/main.tf line 1, in resource "google_storage_bucket" "ignition":
ERROR    1: resource "google_storage_bucket" "ignition" {

This is because 'US' is default in terraform values for 'location':

Expected results: To be able to install Openshift without disabling the policies.

Additional info: Will be uploading install-config and more logs.

Comment 10 To Hung Sze 2020-09-03 20:06:26 UTC
David, could you please refer to below from our project admin on the specific settings your customer is using so that we can get ours set up properly:
It seems that this feature must be configured by GCP Super Admins, and we don't have that permission. Please give details about how you want the permissions configured, and we can pass that to the GCP Super Admins to configure it. We probably want to create a new project just for this, so that the restrictions only apply to that project.


Comment 11 David Hernández Fernández 2020-09-14 07:46:44 UTC
Hi @tsze
Sorry for the late reply, this is already confirmed to be working by the customer even with nightly builds after PR merged: https://github.com/openshift/installer/pull/4089

The configuration can be tested by selecting and configuring any restriction as per official Google Cloud docs: https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations#gcloud

Comment 12 To Hung Sze 2020-09-22 02:14:47 UTC
Thank you. David. I will close this one.

Comment 13 David Hernández Fernández 2020-09-25 10:08:11 UTC
Thank you for the quick resolution.

Comment 16 errata-xmlrpc 2020-10-27 16:30:14 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Platform 4.6 GA Images), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.