[agrawalkhushi18]

This PR resolves an issue where gcluster create failed with a fatal HTTP 404 error on clean Google Cloud projects when validating GCSFuse custom IAM roles (test_gcsfuse_iam_role_exists), forcing users to bypass validation using -l IGNORE.

Architectural Context & Root Cause

1. Separation of Lifecycle Stages (Day 0 vs Day 2):

   • gcluster create (Day 0 - Infrastructure Provisioning): Validates cloud infrastructure feasibility (project existence, enabled APIs, machine types, zones, reservations). It does not have context on runtime user workloads or target GCS buckets.
   • gcluster job submit (Day 2 - Workload Execution): This is where pre-flight IAM validation properly belongs. When a user submits a job targeting a bucket (--mount gs://<bucket>=/data;profile=...), gcluster will inspect the bucket's IAM policy (storage.buckets.getIamPolicy) at runtime and emit non-blocking advisory warnings if permissions are missing.

2. Decoupled Deployment Automation:

   • modules/file-system/gke-persistent-volume already automates granting the required Anywhere Cache permissions to the GKE Service Agent using Google's built-in roles/storage.admin directly on the target bucket, eliminating the requirement for project-level custom IAM role creation (iam.roles.create).

---

Key Changes

• pkg/validators/:

  • Removed test_gcsfuse_iam_role_exists, testGCSFuseIAMRoleExistsCheck, and checkGCSFuseIAMBinding from pkg/validators/cloud.go.
  • Removed testGCSFuseIAMRoleExistsName and blueprintHasGCSFuse from pkg/validators/validators.go and defaults(bp).
  • Cleaned up associated unit tests and unused IAM/CRM client imports.

• modules/file-system/gke-persistent-volume/README.md:

  • Added documentation and blueprint examples for disabling automatic IAM grants (grant_gcsfuse_service_agent_role: false) when targeting shared or pre-configured enterprise buckets.

• examples/:

  • Updated comments across 10 GKE blueprint examples to clarify that roles/storage.admin is automatically granted by default and reference the module documentation for custom least-privilege role overrides.

---

*NOTE: Runtime pre-flight IAM verification against target buckets will be integrated into gcluster job submit as part of the dynamic GCSFuse Storage Profile workflow.

---

Testing

• Ran go test -v ./pkg/validators/... (All 34 tests passed).
• Ran make gcluster (Compiled cleanly with zero errors).
• Ran pre-commit hooks (go fmt, go vet, golangci-lint, yamllint, codespell).

Submission Checklist

NOTE: Community submissions can take up to 2 weeks to be reviewed.

Please take the following actions before submitting this pull request.

• Fork your PR branch from the Toolkit "develop" branch (not main)
• Test all changes with pre-commit in a local branch #
• Confirm that "make tests" passes all tests
• Add or modify unit tests to cover code changes
• Ensure that unit test coverage remains above 80%
• Update all applicable documentation
• Follow Cluster Toolkit Contribution guidelines #

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request removes a legacy IAM role validator that was causing fatal 404 errors during infrastructure provisioning. By decoupling the IAM validation from the initial deployment phase, the change prevents unnecessary blocking of users. Future pre-flight checks will be integrated into the job submission workflow, and documentation has been updated to provide better guidance on managing GCSFuse permissions in various deployment scenarios.

Highlights

• Removal of Legacy Validator: Removed the 'test_gcsfuse_iam_role_exists' validator and its associated logic from the codebase to resolve deployment failures on clean projects.
• Documentation Updates: Updated GKE blueprint examples and added documentation to the 'gke-persistent-volume' module to clarify how to handle IAM role grants for GCSFuse.
• Configuration Flexibility: Introduced the 'grant_gcsfuse_service_agent_role' setting, allowing users to disable automatic IAM grants for shared or pre-configured buckets.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request removes the automatic GCS Fuse IAM role existence validator from the Go codebase. Additionally, it updates several GKE example blueprints to reflect that the GKE Service Agent permissions are now automatically granted by default, and updates the gke-persistent-volume module documentation to explain how to disable automatic IAM grants for shared or pre-configured buckets. I have no further feedback to provide as there are no review comments.