Replace the in cluster greenhouse HTTP cache with a dedicated GCS bucket#5126
Conversation
kubevirt-bot
added
dco-signoff: yes
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request migrates the Bazel remote cache from a local HTTP cache to a Google Cloud Storage (GCS) bucket. It introduces a new preset preset-bazel-cache-gcs-credentials to mount GCS service account credentials, updates numerous Prow job configurations to use this preset, and modifies the bootstrap script create_bazel_cache_rcs.sh to configure Bazel with the GCS remote cache. Feedback suggests wrapping the --google_credentials option in a check to ensure it is only appended when BAZEL_CACHE_GOOGLE_CREDENTIALS is non-empty, preventing Bazel configuration errors when running locally or relying on Application Default Credentials.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Whitedyl
force-pushed
the
migrate-bazel-cache-to-gsp
branch
2 times, most recently
from
8e68310 to
bc1fdff
Compare
|
@dollierp I've made the requested changes can you take a look? |
|
/hold |
kubevirt-bot
added
the
do-not-merge/hold
Whitedyl
force-pushed
the
migrate-bazel-cache-to-gsp
branch
from
bc1fdff to
9c6c8a6
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dollierp The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
kubevirt-bot
added
the
approved
|
/unhold |
kubevirt-bot
added
needs-rebase
|
@Whitedyl it seems you need to resolve merge conflicts here first |
…ket (kubevirt-bazel-cache) as the remote bazel cache backend -Add bazel-cache-gsc Kubernetes Secret to all three worload overlays, sourced from SA in k/secrets repo -Add preset-bazel-cache-gcs-credentials to mount the secret and expose the credential path via BAZEL_CACHE_GOOGLE_CREDENTIALS to avoid conflicts with preset-gcs-credentials) -Update preset-bazel-cache to set BAZEL_REMOTE_CACHE pointing at the GCS bucket URL instead of the greenhouse cluster-local host -Update create_bazel_cache_rcs.sh to use the GCS URL when BAZEL_REMOTE_CACHE is set, preserving per-workspace/toolchain path isolation -Add preset-bazel-cache-gcs-credentials to all 37 jobs that use bazel caching Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Signed-off-by: Dylan White <dywhite@redhat.com>
…test.sh so kustomize can find the SA key file when building the overlay. Guard --google_credentials in create_bazel_cache_rcs.sh so it is only written when BAZEL_CACHE_GOOGLE_CREDENTIALS is non-empty. Update preset-bazel-cache to include GCS bucket URL, credentials env var, and SA secret volume/mount. Remove preset-bazel-cache-gcs-credentials label from 37 job files as credentials are now included directly in preset-bazel-cache. Signed-off-by: Dylan White <dywhite@redhat.com>
Remove duplicated cache_id computation Signed-off-by: Dylan White <dywhite@redhat.com>
Whitedyl
force-pushed
the
migrate-bazel-cache-to-gsp
branch
from
9c6c8a6 to
613007c
Compare
kubevirt-bot
removed
lgtm
Yeah there were additions to deploy.sh and test.sh, I have resolved them now. |
|
@Whitedyl: Updated the
DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
What this PR does / why we need it:
Migrates the Bazel remote cache from the in-cluster greenhouse HTTP service to a dedicated GCS bucket (kubevirt-bazel-cache). Moving to GCS gives us durable, scaleable object storage as well as reducing poisoned cache failures.
Special notes for your reviewer:
/cc @dhiller @dollierp
Please add a /hold after approval as prow-deploy periodic will need to be manually ran after merging to deploy the SA secret to the cluster.
Two follow up PR's will be needed:
Checklist