User Story:

As a user, I want to be able to:

• Skip creating the firewall rules when installing into a Shared VPC, as defined by the networkProjectID variable being set to a non empty string.

so that I can achieve

• Creating an IPI cluster using a Shared VPC with insufficient permissions to create Firewall Rules in the Host Project.

Acceptance Criteria:

Description of criteria:

• A new parameter is added to the install config to designate when to (skip) creat(ing) firewall rules.
• The Terraform firewall rule resources are skipped (count=0) when this parameter is configured.

(optional) Out of Scope:

Handling the ingress firewall rules are out of scope of this story. Of note, the ingress controller will manage them if the associated service account has proper permissions; and it will fail gracefully if it does not. As a result, there isn't any further expectations for this in any card.

Validating that preexisting firewall rules are sufficient to install a cluster are beyond the scope of this story.

Engineering Details:

• https://github.com/openshift/installer/blob/master/data/data/gcp/cluster/network/firewall.tf
• https://github.com/openshift/installer/blob/bdbb3b12afd3654c39a50b0f826580f530c3299e/data/data/gcp/bootstrap/main.tf#L52
•