CORS-4335: Add support for AWS European Sovereign Cloud by tthvo · Pull Request #1360 · openshift/cluster-ingress-operator

tthvo · 2026-02-13T01:26:31Z

AWS European Sovereign Cloud support

This PR allows support for AWS European Sovereign Cloud (EUSC). The Route53 and tagging client should point to the eusc-de-east-1 region in EUSC.

Note: we can only check the region prefix eusc- because the AWS SDK v1 does not recognize the new EUSC partition and regions. Support for EUSC can, as of now, be achieved via custom service endpoint.

ELB v2 custom endpoint

As mentioned, the AWS SDK v1 does not recognize the new EUSC parition and regions. It will, by default, resolve the service endpoint incorrectly. Thus, we will need to provide the service endpoint explicitly for necessary services, including ELB v2 for Network Load Balancers.

This adds custom endpoint support for ELB v2 (to create NLBs). The implementation is based on the following points.

The AWS SDK v1 uses the same service ID elasticloadbalancing for both ELB and ELB v2. See similar discussion.
When a custom endpoint is specified for ELB, it should also apply to ELB v2. This change ensures both services use the custom endpoint when configured.

STS custom endpoint

This change originates from the similar reason as ELB v2 custom endpoint. We need to be able to customize the STS endpoint in order to assume role for managing shared hosted zone in EUSC.

openshift-ci-robot · 2026-02-13T01:26:35Z

@tthvo: This pull request explicitly references no jira issue.

Details

In response to this:

Forward-compatibility

This PR allows forward-compatibility with newly released AWS partitions (such as European Sovereign Cloud) by skipping Route53 and tagging client region configuration in unknown/non-standard AWS partitions. Otherwise, installing in a new partition will always incorrectly use us-east-1 clients, which fails due to credential region mismatch.

ELB v2 custom endpoint

This also adds custom endpoint support for ELB v2 (to create NLBs). The implementation is based on the following points.

The AWS SDK v1 uses the same service ID elasticloadbalancing for both ELB and ELB v2. See similar discussion.

When a custom endpoint is specified for ELB, it should also apply to ELB v2. This change ensures both services use the custom endpoint when configured.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tthvo · 2026-02-13T01:31:42Z

/hold

I am unsure if this is the right approach. As of now, we can only support EUSC via custom service endpoint (see openshift/installer#10303) because AWS SDK v1 is EOL and doesn't support it out of the box. I don't think migrating to AWS SDK v2 is trivial at all...

Please let me know if this works 🙏

tthvo · 2026-02-13T01:33:09Z

/cc @alebedev87 @patrickdillon @rna-afk

openshift-ci-robot · 2026-02-13T10:28:20Z

@tthvo: This pull request references CORS-4335 which is a valid jira issue.

Details

In response to this:

AWS European Sovereign Cloud support

This PR allows support for AWS European Sovereign Cloud (EUSC). The Route53 and tagging client should point to the eusc-de-east-1 region in EUSC.

Note: we can only check the region prefix eusc- because the AWS SDK v1 does not recognize the new EUSC partition and regions.

ELB v2 custom endpoint

As mentioned, the AWS SDK v1 does not recognize the new EUSC parition and regions. It will, by default, resolve the service endpoint incorrectly. Thus, we will need to provide the service endpoint explicitly for necessary services, including ELB v2 for Network Load Balancers.

This adds custom endpoint support for ELB v2 (to create NLBs). The implementation is based on the following points.

The AWS SDK v1 uses the same service ID elasticloadbalancing for both ELB and ELB v2. See similar discussion.

When a custom endpoint is specified for ELB, it should also apply to ELB v2. This change ensures both services use the custom endpoint when configured.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-02-13T10:28:52Z

@tthvo: This pull request references CORS-4335 which is a valid jira issue.

Details

In response to this:

AWS European Sovereign Cloud support

This PR allows support for AWS European Sovereign Cloud (EUSC). The Route53 and tagging client should point to the eusc-de-east-1 region in EUSC.

Note: we can only check the region prefix eusc- because the AWS SDK v1 does not recognize the new EUSC partition and regions. Support for EUSC can, as of now, be achieved via custom service endpoint.

ELB v2 custom endpoint

As mentioned, the AWS SDK v1 does not recognize the new EUSC parition and regions. It will, by default, resolve the service endpoint incorrectly. Thus, we will need to provide the service endpoint explicitly for necessary services, including ELB v2 for Network Load Balancers.

This adds custom endpoint support for ELB v2 (to create NLBs). The implementation is based on the following points.

The AWS SDK v1 uses the same service ID elasticloadbalancing for both ELB and ELB v2. See similar discussion.

When a custom endpoint is specified for ELB, it should also apply to ELB v2. This change ensures both services use the custom endpoint when configured.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tthvo · 2026-02-13T18:18:12Z

/retest

openshift-ci-robot · 2026-02-18T04:33:16Z

@tthvo: This pull request references CORS-4335 which is a valid jira issue.

Details

In response to this:

AWS European Sovereign Cloud support

This PR allows support for AWS European Sovereign Cloud (EUSC). The Route53 and tagging client should point to the eusc-de-east-1 region in EUSC.

Note: we can only check the region prefix eusc- because the AWS SDK v1 does not recognize the new EUSC partition and regions. Support for EUSC can, as of now, be achieved via custom service endpoint.

ELB v2 custom endpoint

As mentioned, the AWS SDK v1 does not recognize the new EUSC parition and regions. It will, by default, resolve the service endpoint incorrectly. Thus, we will need to provide the service endpoint explicitly for necessary services, including ELB v2 for Network Load Balancers.

This adds custom endpoint support for ELB v2 (to create NLBs). The implementation is based on the following points.

The AWS SDK v1 uses the same service ID elasticloadbalancing for both ELB and ELB v2. See similar discussion.

When a custom endpoint is specified for ELB, it should also apply to ELB v2. This change ensures both services use the custom endpoint when configured.

STS custom endpoint

This change originates from the similar reason as ELB v2 custom endpoint. We need to be able to customize the STS endpoint in order to assume role for managing shared hosted zone in EUSC.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

tthvo · 2026-02-18T05:49:13Z

/retest

tthvo · 2026-02-18T21:06:08Z

/retest

tthvo · 2026-02-18T21:22:53Z

/hold cancel

Tested locally with openshift/installer#10303 and the install completed successfully in EUS Cloud.

tthvo · 2026-02-19T01:10:35Z

/test e2e-aws-operator

alebedev87 · 2026-02-25T15:37:55Z

/assign

patrickdillon · 2026-02-25T18:25:09Z

would these changes be necessary at all if the operator were on v2 of the aws sdk?

tthvo · 2026-02-25T18:29:11Z

would these changes be necessary at all if the operator were on v2 of the aws sdk?

Oh no, in that case, the only commit needed is 7806b67, where we must use eusc-de-east-1 for tagging and route53 client. The SDK v2 (some latest versions) will automatically resolves the EUSC endpoints out of the box.

This commit adds CI infrastructure support for AWS European Sovereign Cloud (EUSC) testing using the eusc-de-east-1 region. Changes: - Add cluster-secrets-aws-eusc-qe to secret bootstrap config - Add aws-eusc-qe-quota-slice boskos resource pool with 5 quota slices in eusc-de-east-1 region - Generate updated _boskos.yaml configuration The profile uses vault secret: cluster-secrets-aws-eusc-qe Region Details: - Region: eusc-de-east-1 (Brandenburg, Germany) - Availability zones: eusc-de-east-1a, eusc-de-east-1b (2 zones only) - Note: No edge zones (Local/Wavelength) available in this region Dependencies: - Installer support: openshift/installer#10303 - Ingress operator support: openshift/cluster-ingress-operator#1360 - API support (optional): openshift/api#2708 Tested installation scenarios (from installer PR openshift#10303): - ✅ Default minimal config - ✅ Ingress NLB type - ✅ BYO Private Hosted zone - ✅ BYO KMS key - ✅ BYO VPC and subnets Installation time: ~45m26s Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

The AWS SDK v1 uses the same service ID "elasticloadbalancing" for elb and elbv2. Thus, if defined, we need to use the custom service endpoint for both.

… Cloud Add support for AWS European Sovereign Cloud (EUSC) regions by configuring Route53 and tagging clients to use eusc-de-east-1 region. Since Route 53 is not a regionalized service in EUSC, the Tagging API will only return hosted zone resources when the region is set to eusc-de-east-1.

tthvo · 2026-03-25T17:51:54Z

/retest

tthvo · 2026-03-25T17:52:05Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.22-arm64-nightly-aws-ipi-disc-priv-sts-ep-mini-perm-f14

openshift-ci · 2026-03-25T17:52:24Z

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-4.22-arm64-nightly-aws-ipi-disc-priv-sts-ep-mini-perm-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/571107c0-2873-11f1-9612-8fd63eaa95bf-0

tthvo · 2026-03-25T19:48:26Z

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.22-arm64-nightly-aws-ipi-disc-priv-sts-ep-mini-perm-f14

openshift-ci · 2026-03-25T19:48:29Z

@tthvo: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

periodic-ci-openshift-openshift-tests-private-release-4.22-arm64-nightly-aws-ipi-disc-priv-sts-ep-mini-perm-f14

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/971bbbc0-2883-11f1-9822-81f95ba6698b-0

tthvo · 2026-03-25T19:50:37Z

With the latest push, I have dropped commits that add support for STS custom endpoint. For that reason, EUSC install will only support Mint and Passthrough credentialsMode case (except shared phz, which uses STS).

alebedev87

/lgtm
/approve

As agreed, the STS custom endpoint is removed from this PR. So EUSC support comes without STS for the moment (image registry is another component which has a gap for STS custom endpoint).

openshift-ci · 2026-03-26T10:17:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

alebedev87 · 2026-03-26T13:41:12Z

/assign @liweinan

For verification..

liweinan · 2026-03-26T13:43:58Z

/verified by liweinan

openshift-ci-robot · 2026-03-26T13:44:14Z

@liweinan: This PR has been marked as verified by liweinan.

Details

In response to this:

/verified by liweinan

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

alebedev87 · 2026-03-26T16:25:52Z

/test e2e-aws-ovn-hypershift-conformance

Some unrelated storage issues, retesting..

openshift-ci-robot · 2026-03-26T17:04:54Z

/retest-required

Remaining retests: 0 against base HEAD a6176ea and 2 for PR HEAD 34fd6fa in total

tthvo · 2026-03-26T20:21:22Z

/test e2e-aws-ovn-hypershift-conformance

Let's try again 😅

openshift-ci · 2026-03-26T23:08:24Z

@tthvo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

tthvo · 2026-03-26T23:10:27Z

/tide refresh

It's time :D

lihongan · 2026-03-30T00:57:59Z

Change included in accepted release 4.22.0-0.nightly-2026-03-29-055437

liweinan · 2026-03-30T02:45:06Z

Change included in accepted release 4.22.0-0.nightly-2026-03-29-055437

@lihongan Thanks for the work! I retried the test jobs here: openshift/release#75568

This commit adds CI infrastructure support for AWS European Sovereign Cloud (EUSC) testing using the eusc-de-east-1 region. Changes: - Add cluster-secrets-aws-eusc-qe to secret bootstrap config - Add aws-eusc-qe-quota-slice boskos resource pool with 5 quota slices in eusc-de-east-1 region - Generate updated _boskos.yaml configuration Region Details: - Region: eusc-de-east-1 (Brandenburg, Germany) - Availability zones: eusc-de-east-1a, eusc-de-east-1b (2 zones only) - Note: No edge zones (Local/Wavelength) available in this region Dependencies: - Installer support: openshift/installer#10303 - Ingress operator support: openshift/cluster-ingress-operator#1360 - API support (optional): openshift/api#2708

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 13, 2026

openshift-ci Bot requested review from davidesalerno and grzpiotrowski February 13, 2026 01:27

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 13, 2026

openshift-ci Bot requested review from alebedev87, patrickdillon and rna-afk February 13, 2026 01:33

tthvo mentioned this pull request Feb 13, 2026

CORS-4336: Support for AWS European Sovereign Cloud openshift/installer#10303

Merged

tthvo force-pushed the eusc-support branch from fe58d61 to eb66555 Compare February 13, 2026 10:09

tthvo changed the title ~~NO-JIRA: support unknown/newly-released AWS partitions and ELB v2 endpoints~~ CORS-4335: Add support for AWS European Sovereign Cloud Feb 13, 2026

tthvo force-pushed the eusc-support branch 2 times, most recently from be85531 to 6cb9548 Compare February 18, 2026 04:31

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Feb 18, 2026

tthvo mentioned this pull request Feb 18, 2026

CORS-4337: allow AWS Europe Sovereign Cloud partition openshift/api#2708

Merged

openshift-ci Bot assigned alebedev87 Feb 25, 2026

tthvo added 3 commits March 25, 2026 06:56

endpoint: support custom endpoint for ELB v2

e1e5a26

The AWS SDK v1 uses the same service ID "elasticloadbalancing" for elb and elbv2. Thus, if defined, we need to use the custom service endpoint for both.

test: update unit tests for AWS client provider

34fd6fa

tthvo force-pushed the eusc-support branch from 4bf1b2f to 34fd6fa Compare March 25, 2026 13:57

openshift-ci Bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 25, 2026

alebedev87 approved these changes Mar 26, 2026

View reviewed changes

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 26, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 26, 2026

openshift-ci Bot assigned liweinan Mar 26, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Mar 26, 2026

openshift-merge-bot Bot merged commit d16dd45 into openshift:master Mar 26, 2026
19 checks passed

tthvo deleted the eusc-support branch March 26, 2026 23:13

Conversation

tthvo commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 13, 2026

Uh oh!

tthvo commented Feb 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tthvo commented Feb 13, 2026

Uh oh!

openshift-ci-robot commented Feb 13, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Feb 13, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tthvo commented Feb 13, 2026

Uh oh!

openshift-ci-robot commented Feb 18, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tthvo commented Feb 18, 2026

Uh oh!

tthvo commented Feb 18, 2026

Uh oh!

tthvo commented Feb 18, 2026

Uh oh!

tthvo commented Feb 19, 2026

Uh oh!

alebedev87 commented Feb 25, 2026

Uh oh!

patrickdillon commented Feb 25, 2026

Uh oh!

tthvo commented Feb 25, 2026

Uh oh!

tthvo commented Mar 25, 2026

Uh oh!

tthvo commented Mar 25, 2026

Uh oh!

openshift-ci Bot commented Mar 25, 2026

Uh oh!

tthvo commented Mar 25, 2026

Uh oh!

openshift-ci Bot commented Mar 25, 2026

Uh oh!

tthvo commented Mar 25, 2026

Uh oh!

alebedev87 left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Mar 26, 2026

Uh oh!

alebedev87 commented Mar 26, 2026

Uh oh!

liweinan commented Mar 26, 2026

Uh oh!

openshift-ci-robot commented Mar 26, 2026

Uh oh!

alebedev87 commented Mar 26, 2026

Uh oh!

openshift-ci-robot commented Mar 26, 2026

Uh oh!

tthvo commented Mar 26, 2026

Uh oh!

openshift-ci Bot commented Mar 26, 2026

Uh oh!

tthvo commented Mar 26, 2026

Uh oh!

Uh oh!

lihongan commented Mar 30, 2026

Uh oh!

liweinan commented Mar 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

tthvo commented Feb 13, 2026 •

edited

Loading

tthvo commented Feb 13, 2026 •

edited

Loading

openshift-ci-robot commented Feb 13, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Feb 13, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Feb 18, 2026 •

edited by openshift-ci Bot

Loading