openshift · rochacbruno · Aug 3, 2026 · Aug 3, 2026 · Aug 4, 2026
diff --git a/_attributes/common-attributes.adoc b/_attributes/common-attributes.adoc
@@ -295,6 +295,8 @@ endif::[]
 :gcp-first: Google Cloud
 :gcp-full: Google Cloud
 :gcp-short: Google Cloud
+// Google Cloud Dedicated (sovereign cloud)
+:gcp-dedicated: Google Cloud Dedicated
 // IBM general
 :ibm-name: IBM(R)
 :ibm-title: IBM

diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml
@@ -335,6 +335,8 @@ Topics:
     File: installing-gcp-shared-vpc
   - Name: Installing a private cluster on Google Cloud
     File: installing-gcp-private
+  - Name: Installing a cluster on Google Cloud into a sovereign cloud region
+    File: installing-gcp-sovereign-cloud
   - Name: Installing a cluster on Google Cloud using Infrastructure Manager templates
     File: installing-gcp-user-infra
   - Name: Installing a cluster into a shared VPC on Google Cloud using Infrastructure Manager templates

diff --git a/installing/installing_gcp/installing-gcp-sovereign-cloud.adoc b/installing/installing_gcp/installing-gcp-sovereign-cloud.adoc
@@ -0,0 +1,82 @@
+:_mod-docs-content-type: ASSEMBLY
+[id="installing-gcp-sovereign-cloud"]
+= Installing a cluster on {gcp-short} into a sovereign cloud region
+include::_attributes/common-attributes.adoc[]
+:context: installing-gcp-sovereign-cloud
+
+toc::[]
+
+[role="_abstract"]
+In {product-title} version {product-version}, you can install a cluster on a Google Cloud Dedicated (GCD) sovereign cloud region. GCD is a fully isolated cloud environment that provides Google Cloud technology with strict data and operational sovereignty guarantees.
+
+To configure the sovereign cloud region, you modify parameters in the `install-config.yaml` file before you install the cluster.
+
+:FeatureName: Installing a cluster on {gcp-short} into a sovereign cloud region
+include::snippets/technology-preview.adoc[leveloffset=+1]
+
+include::modules/installation-gcp-about-sovereign-cloud.adoc[leveloffset=+1]
+
+include::modules/installation-gcp-sovereign-cloud-limitations.adoc[leveloffset=+1]
+
+[id="prerequisites_{context}"]
+== Prerequisites
+
+* You reviewed details about the xref:../../architecture/architecture-installation.adoc#architecture-installation[{product-title} installation and update] processes.
+* You read the documentation on xref:../../installing/overview/installing-preparing.adoc#installing-preparing[selecting a cluster installation method and preparing it for users].
+* You xref:../../installing/installing_gcp/installing-gcp-account.adoc#installing-gcp-account[configured a {gcp-short} project] to host the cluster.
+* You have a GCD service account credential file that includes the `universe_domain` field for your sovereign cloud region.
+* If you use a firewall, you xref:../../installing/install_config/configuring-firewall.adoc#configuring-firewall-module_configuring-firewall[configured it to allow the sites] that your cluster requires access to, including the GCD API endpoints for your region.
+
+include::modules/installation-gcp-sovereign-cloud-prerequisites.adoc[leveloffset=+1]
+
+include::modules/cluster-entitlements.adoc[leveloffset=+1]
+
+include::modules/ssh-agent-using.adoc[leveloffset=+1]
+
+include::modules/installation-obtaining-installer.adoc[leveloffset=+1]
+
+include::modules/installation-initializing-manual.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+* xref:../../installing/installing_gcp/installation-config-parameters-gcp.adoc#installation-config-parameters-gcp[Installation configuration parameters for {gcp-short}]
+
+include::modules/installation-gcp-sovereign-cloud-config-yaml.adoc[leveloffset=+2]
+
+include::modules/installation-minimum-resource-requirements.adoc[leveloffset=+2]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../../scalability_and_performance/optimization/optimizing-storage.adoc#optimizing-storage[Optimizing storage]
+
+include::modules/installation-gcp-sovereign-cloud-machine-types.adoc[leveloffset=+2]
+
+include::modules/installation-configure-proxy.adoc[leveloffset=+2]
+
+[id="installing-gcp-sovereign-cloud-manual-modes_{context}"]
+== Alternatives to storing administrator-level secrets in the kube-system project
+
+By default, administrator secrets are stored in the `kube-system` project. If you configured the `credentialsMode` parameter in the `install-config.yaml` file to `Manual`, you must use one of the following alternatives:
+
+* To manage long-term cloud credentials manually, follow the procedure in xref:../../installing/installing_gcp/installing-gcp-sovereign-cloud.adoc#manually-create-iam_installing-gcp-sovereign-cloud[Manually creating long-term credentials].
+
+//Manually creating long-term credentials
+include::modules/manually-create-identity-access-management.adoc[leveloffset=+2]
+
+include::modules/installation-launching-installer.adoc[leveloffset=+1]
+
+include::modules/cli-logging-in-kubeadmin.adoc[leveloffset=+1]
+
+[role="_additional-resources"]
+.Additional resources
+
+* xref:../../web_console/web-console.adoc#web-console[Accessing the web console]
+
+[id="next-steps_{context}"]
+== Next steps
+
+* xref:../../installing/validation_and_troubleshooting/validating-an-installation.adoc#validating-an-installation[Validating an installation].
+* xref:../../post_installation_configuration/cluster-tasks.adoc#available_cluster_customizations[Customize your cluster].
+* If necessary, you can xref:../../support/remote_health_monitoring/remote-health-reporting.adoc#remote-health-reporting[Remote health reporting].
+* If necessary, you can xref:../../post_installation_configuration/changing-cloud-credentials-configuration.adoc#manually-removing-cloud-creds_changing-cloud-credentials-configuration[remove cloud provider credentials].
diff --git a/installing/installing_gcp/preparing-to-install-on-gcp.adoc b/installing/installing_gcp/preparing-to-install-on-gcp.adoc
@@ -42,6 +42,8 @@ You can install a cluster on {gcp-short} infrastructure that is provisioned by t
 
 * **xref:../../installing/installing_gcp/installing-gcp-private.adoc#installing-gcp-private[Installing a private cluster on an existing VPC]**: You can install a private cluster on an existing {gcp-short} VPC. You can use this method to deploy {product-title} on an internal network that is not visible to the internet.
 
+* **xref:../../installing/installing_gcp/installing-gcp-sovereign-cloud.adoc#installing-gcp-sovereign-cloud[Installing a cluster on {gcp-short} into a sovereign cloud region]**: You can install {product-title} on a Google Cloud Dedicated (GCD) sovereign cloud region. GCD is a fully isolated cloud environment with strict data and operational sovereignty guarantees. This feature is a Technology Preview feature.
+
 [id="choosing-an-method-to-install-ocp-on-gcp-user-provisioned"]
 === Installing a cluster on user-provisioned infrastructure
 

diff --git a/modules/installation-gcp-about-sovereign-cloud.adoc b/modules/installation-gcp-about-sovereign-cloud.adoc
@@ -0,0 +1,74 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_gcp/installing-gcp-sovereign-cloud.adoc
+
+:_mod-docs-content-type: CONCEPT
+[id="installation-gcp-about-sovereign-cloud_{context}"]
+= {gcp-short} sovereign cloud regions
+
+Google Cloud Dedicated (GCD) is a sovereign cloud platform that provides Google Cloud technology and services in a fully isolated environment with strict data and operational sovereignty guarantees. GCD operates as a separate universe from public Google Cloud, with its own networking, API endpoints, and management infrastructure completely disconnected from public Google Cloud.
+
+{product-title} supports deploying clusters to GCD sovereign cloud regions by using installer-provisioned infrastructure.
+
+[NOTE]
+====
+The GCD sovereign cloud region cannot be selected by using the guided terminal prompts from the installation program. You must define the region and other GCD-specific parameters manually in the `install-config.yaml` file.
+====
+
+[id="gcp-sovereign-cloud-key-differences_{context}"]
+== Key differences from public {gcp-short}
+
+GCD regions differ from public {gcp-short} in several ways that affect {product-title} installation and operation:
+
+Single region per universe:: Each GCD deployment operates as a single region. Multi-region features such as cross-region load balancing and multi-region storage are not available. You must use multiple zones within the single region for high availability.
+
+Different API endpoints:: GCD uses API endpoints in the format `<service>.apis-<region-host>.goog` instead of `<service>.googleapis.com`. For example, the Berlin region uses `compute.apis-berlin-build0.goog` instead of `compute.googleapis.com`.
+
+Domain-scoped project IDs:: All GCD project IDs carry a mandatory prefix, such as `eu0:`. For example, a project named `my-project` has the project ID `eu0:my-project`. You must include this prefix in all commands and configuration.
+
+Different service account email format:: Service account email addresses use GCD-specific domains. User-managed service accounts use the format `<name>@<project-name>.<prefix>.iam.gserviceaccount.com`. For example, `my-sa@my-project.eu0.iam.gserviceaccount.com`.
+
+Limited service availability:: Only a subset of Google Cloud services is available. Older Compute Engine machine types, ARM-based instances, TPUs, and several other services are not available.
+
+No Cloud Identity:: GCD does not support Google Accounts or Google Groups for identity management. Authentication must use Workforce Identity Federation with an external identity provider (IdP) or service accounts.
+
+No default VPC:: A default VPC network is not automatically created for new projects. You must create or configure a VPC explicitly.
+
+[id="gcp-sovereign-cloud-openshift-constraints_{context}"]
+== {product-title} constraints on GCD
+
+The following constraints apply when you install {product-title} on a GCD sovereign cloud region:
+
+* This feature is a Technology Preview feature. You must set the `featureSet` parameter to `TechPreviewNoUpgrade` in the `install-config.yaml` file.
+
+* Only the C3, M3, and A3 Edge machine series are available. The default instance type is `c3-standard-4`. Other series such as N2, E2, and T2A are not available.
+
+* Only the `hyperdisk-balanced` disk type is available. Other disk types such as `pd-ssd`, Persistent Disk, and Local SSD are not available.
+
+* The {op-system-first} image is not pre-published in GCD regions. You must upload a custom {op-system} image to your GCD project and specify it in the `install-config.yaml` file.
+
+* Only private DNS zones are supported. You must set the `publish` parameter to `Internal` in the `install-config.yaml` file.
+
+* Private Service Connect (PSC) endpoint overrides are not supported. Do not set the `platform.gcp.endpoint` field in the `install-config.yaml` file.
+
+* The universe domain from the GCD credentials is exposed on the `Infrastructure` custom resource (CR) at `status.platformStatus.gcp.universeDomain`. Cluster components use this value to determine the correct API endpoints.
+
+[id="gcp-sovereign-cloud-supported-regions_{context}"]
+== Supported GCD regions
+
+The following GCD sovereign cloud regions are supported for {product-title} installation:
+
+.GCD regions
+[cols="1,1,1",options="header"]
+|====
+|Region |Identifier |Zones
+
+|Berlin, Germany
+|`u-germany-northeast1`
+|`u-germany-northeast1-a`, `u-germany-northeast1-b`, `u-germany-northeast1-c`
+|====
+
+[NOTE]
+====
+Additional GCD regions may be supported in future releases. The architectural constraints described in this document, such as the single-region design, limited machine types, and different API endpoints, apply to all GCD regions.
+====
diff --git a/modules/installation-gcp-sovereign-cloud-config-yaml.adoc b/modules/installation-gcp-sovereign-cloud-config-yaml.adoc
@@ -0,0 +1,69 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_gcp/installing-gcp-sovereign-cloud.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="installation-gcp-sovereign-cloud-config-yaml_{context}"]
+= Sample install-config.yaml file for a GCD sovereign cloud region
+
+The following `install-config.yaml` file demonstrates the required configuration for installing {product-title} on a Google Cloud Dedicated (GCD) sovereign cloud region.
+
+[IMPORTANT]
+====
+This sample YAML file is provided for reference only. You must obtain your `install-config.yaml` file by using the installation program and modify it to include the GCD-specific parameters.
+====
+
+[source,yaml]
+----
+apiVersion: v1
+baseDomain: example.com <1>
+featureSet: TechPreviewNoUpgrade <2>
+controlPlane:
+  name: master
+  replicas: 3
+  platform:
+    gcp:
+      type: c3-standard-4 <3>
+      osDisk:
+        diskType: hyperdisk-balanced <4>
+        diskSizeGB: 128
+compute:
+- name: worker
+  replicas: 3
+  platform:
+    gcp:
+      type: c3-standard-4 <3>
+      osDisk:
+        diskType: hyperdisk-balanced <4>
+        diskSizeGB: 128
+metadata:
+  name: my-gcd-cluster
+networking:
+  clusterNetwork:
+  - cidr: 10.128.0.0/14
+    hostPrefix: 23
+  machineNetwork:
+  - cidr: 10.0.0.0/16
+  serviceNetwork:
+  - 172.30.0.0/16
+platform:
+  gcp:
+    projectID: eu0:my-project <5>
+    region: u-germany-northeast1 <6>
+    defaultMachinePlatform:
+      osImage:
+        name: my-custom-rhcos <7>
+        project: eu0:my-image-project <8>
+publish: Internal <9>
+pullSecret: '{"auths": ...}'
+sshKey: ssh-ed25519 AAAA...
+----
+<1> The base domain of the cluster. This must correspond to a private DNS zone configured in your GCD project.
+<2> Required. GCD sovereign cloud support requires the `TechPreviewNoUpgrade` feature set.
+<3> A machine type from the C3, M3, or A3 Edge series. The default is `c3-standard-4`. Other series such as N2, E2, and T2A are not available in GCD.
+<4> The disk type. Only `hyperdisk-balanced` is available in GCD. If not specified, the installer defaults to `hyperdisk-balanced` for sovereign cloud installations.
+<5> The domain-scoped project ID for your GCD project. The project ID must include the prefix, such as `eu0:`.
+<6> The GCD region identifier. For the Berlin region, use `u-germany-northeast1`.
+<7> Required. The name of a custom {op-system} image that you uploaded to your GCD project. The {op-system} image is not pre-published in GCD regions.
+<8> Required. The GCD project that contains the custom {op-system} image.
+<9> Required. GCD supports only private DNS zones. Set to `Internal` to use private API endpoints and application routes.
diff --git a/modules/installation-gcp-sovereign-cloud-limitations.adoc b/modules/installation-gcp-sovereign-cloud-limitations.adoc
@@ -0,0 +1,74 @@
+// Module included in the following assemblies:
+//
+// * installing/installing_gcp/installing-gcp-sovereign-cloud.adoc
+
+:_mod-docs-content-type: REFERENCE
+[id="installation-gcp-sovereign-cloud-limitations_{context}"]
+= Limitations for {product-title} on GCD sovereign cloud regions
+
+The following limitations apply to {product-title} clusters installed on Google Cloud Dedicated (GCD) sovereign cloud regions.
+
+[id="gcp-sovereign-cloud-limitations-machine-disk_{context}"]
+== Machine types and disk types
+
+* Only the C3, M3, and A3 Edge machine series are available. The installer defaults to `c3-standard-4` for all machine pools. If you specify a machine type from an unavailable series, the installation fails.
+
+* Only the `hyperdisk-balanced` disk type is available. The installer defaults to `hyperdisk-balanced` for sovereign cloud installations. Other disk types such as `pd-ssd`, `pd-standard`, and Local SSD are not available.
+
+* The installer validates disk type availability against the GCD API on a per-zone basis. If a disk type is not available in the specified zones, the installation fails with an error indicating the unavailable zones.
+
+* ARM-based (aarch64) machine types and images are not available.
+
+[id="gcp-sovereign-cloud-limitations-storage_{context}"]
+== Storage
+
+* Because only the `hyperdisk-balanced` disk type is available in GCD, you must change the default storage class to use `hyperdisk-balanced` after installation. The default storage class provisioned by the installer uses `pd-ssd`, which is not available in GCD regions. For instructions on modifying storage classes, see the "GCE PersistentDisk (gcePD) object definition" section in _Dynamic provisioning_ in _Storage_.
+
+* Cloud Storage is available but limited to single-region buckets only. Dual-region, multi-region, and bucket relocation are not available.
+
+* Cloud Storage bucket locations must be set explicitly. There is no default bucket location in GCD.
+
+[id="gcp-sovereign-cloud-limitations-os-image_{context}"]
+== Operating system image
+
+The {op-system-first} image is not pre-published in GCD regions. You must provide a custom OS image that has been uploaded to your GCD project.
+
+Specify the OS image by using the `platform.gcp.defaultMachinePlatform.osImage` field or per-machine-pool `osImage` fields. You must provide both the `name` and `project` fields. The installation fails if these fields are not set.
+
+.Example custom OS image configuration
+[source,yaml]
+----
+platform:
+  gcp:
+    defaultMachinePlatform:
+      osImage:
+        name: my-custom-rhcos
+        project: eu0:my-image-project
+----
+
+[id="gcp-sovereign-cloud-limitations-networking_{context}"]
+== Networking
+
+* Only private DNS zones are supported. Public DNS zones are not available in GCD. You must set the `publish` parameter to `Internal` in the `install-config.yaml` file.
+
+* Private Service Connect (PSC) endpoint overrides are not supported. Do not set the `platform.gcp.endpoint` field in the `install-config.yaml` file. PSC endpoint overrides generate URLs targeting the `googleapis.com` domain, which is not compatible with GCD sovereign cloud environments.
+
+* A default VPC network is not automatically created for new GCD projects. You must create or specify a VPC network before installation.
+
+[id="gcp-sovereign-cloud-limitations-identity_{context}"]
+== Identity and service accounts
+
+* Service account email addresses use a different domain format in GCD. For domain-scoped project IDs (for example, `eu0:my-project`), the installer generates service account emails in the format `<name>@<project-name>.<prefix>.iam.gserviceaccount.com` instead of the standard `<name>@<project-id>.iam.gserviceaccount.com`.
+
+* Google Accounts and Google Groups are not supported for IAM bindings. Use Workforce Identity Federation or service accounts.
+
+* The GCD credential file does not populate the `project_id` field. The installer reads the project ID from the `platform.gcp.projectID` field in the `install-config.yaml` file instead.
+
+[id="gcp-sovereign-cloud-limitations-other_{context}"]
+== Other limitations
+
+* GCD sovereign cloud support is a Technology Preview feature. You must set `featureSet: TechPreviewNoUpgrade` in the `install-config.yaml` file. Clusters installed with this feature set cannot be upgraded to a later version.
+
+* The installer automatically detects a GCD sovereign cloud environment based on the domain-scoped project ID prefix (for example, `eu0:`) and the universe domain in the credential file.
+
+* The universe domain from the GCD credentials is recorded on the cluster's `Infrastructure` custom resource at `status.platformStatus.gcp.universeDomain`. Cluster components use this value to route API requests to the correct GCD endpoints.