From 9106e33603adb06405da40948a4cc1caaecfca33 Mon Sep 17 00:00:00 2001
From: "openshift-merge-bot[bot]"
 <148852131+openshift-merge-bot[bot]@users.noreply.github.com>
Date: Thu, 30 Jul 2026 23:54:54 +0000
Subject: [PATCH 1/2] CORS-4516: GCP: Update Required Permissions

Updates the required permissions needed for GCP. Currently these
are only used for GCD.
---
 ...-manager-operator_16_credentialsrequest-gcp.yaml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
index 2137688f4..6a80ed2e3 100644
--- a/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
+++ b/manifests/0000_26_cloud-controller-manager-operator_16_credentialsrequest-gcp.yaml
@@ -18,9 +18,13 @@ spec:
     kind: GCPProviderSpec
     permissions:
     - "compute.addresses.create"
+    - "compute.addresses.createInternal"
     - "compute.addresses.delete"
+    - "compute.addresses.deleteInternal"
     - "compute.addresses.get"
     - "compute.addresses.list"
+    - "compute.addresses.use"
+    - "compute.addresses.useInternal"
     - "compute.firewalls.create"
     - "compute.firewalls.delete"
     - "compute.firewalls.get"
@@ -32,25 +36,34 @@ spec:
     - "compute.healthChecks.delete"
     - "compute.healthChecks.get"
     - "compute.healthChecks.update"
+    - "compute.healthChecks.useReadOnly"
     - "compute.httpHealthChecks.create"
     - "compute.httpHealthChecks.delete"
     - "compute.httpHealthChecks.get"
     - "compute.httpHealthChecks.update"
+    - "compute.httpHealthChecks.useReadOnly"
     - "compute.instanceGroups.create"
     - "compute.instanceGroups.delete"
     - "compute.instanceGroups.get"
+    - "compute.instanceGroups.list"
     - "compute.instanceGroups.update"
+    - "compute.instanceGroups.use"
     - "compute.instances.get"
+    - "compute.instances.list"
     - "compute.instances.use"
+    - "compute.networks.updatePolicy"
     - "compute.regionBackendServices.create"
     - "compute.regionBackendServices.delete"
     - "compute.regionBackendServices.get"
     - "compute.regionBackendServices.update"
+    - "compute.regionBackendServices.use"
+    - "compute.subnetworks.use"
     - "compute.targetPools.addInstance"
     - "compute.targetPools.create"
     - "compute.targetPools.delete"
     - "compute.targetPools.get"
     - "compute.targetPools.removeInstance"
+    - "compute.targetPools.use"
     - "compute.zones.list"
 
     # If set to true, don't check whether the requested

From 3ad4eb39439c5c89c9cbbee068d4ddb9fec75a11 Mon Sep 17 00:00:00 2001
From: "openshift-merge-bot[bot]"
 <148852131+openshift-merge-bot[bot]@users.noreply.github.com>
Date: Thu, 13 Aug 2026 17:00:27 +0000
Subject: [PATCH 2/2] CORS-4551: GCP: mount bound sa token volume

On GCP, we should mount the bound sa token volume, similarly to how
it is done on Azure. Typically the volume is mounted by the CCO
webhook, but that pattern is problematic if the CCM needs the
projected credentials to schedule the CCO to run it's webhook, in
which case we hit a deadlock. We can avoid this entirely by simply
always mounting.

This doesn't occur in most installs because the CCM is authenticated
by a VM attached to the service account, but GCD uses a projected
credential and we want to move that direction for all installs
because you can dynamically upgrade permissions.
---
 pkg/cloud/gcp/assets/cloud-controller-manager.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkg/cloud/gcp/assets/cloud-controller-manager.yaml b/pkg/cloud/gcp/assets/cloud-controller-manager.yaml
index f28ce5ec8..223a55ad4 100644
--- a/pkg/cloud/gcp/assets/cloud-controller-manager.yaml
+++ b/pkg/cloud/gcp/assets/cloud-controller-manager.yaml
@@ -117,6 +117,9 @@ spec:
             - name: trusted-ca
               mountPath: /etc/pki/ca-trust/extracted/pem
               readOnly: true
+            - name: bound-sa-token
+              mountPath: /var/run/secrets/openshift/serviceaccount
+              readOnly: true
       volumes:
         - name: config-gccm
           configMap:
@@ -137,3 +140,9 @@ spec:
             items:
               - key: ca-bundle.crt
                 path: tls-ca-bundle.pem
+        - name: bound-sa-token
+          projected:
+            sources:
+            - serviceAccountToken:
+                path: token
+                audience: openshift