[ROSAENG-16042] osdctl break glass cleanup fails for GCP PSC clusters

[RaphaelBut]

The osdctl cluster break glass cleanup command does not properly clean up resources for PSC (Private Service Connect) clusters. Resources need to be manually cleaned up instead.

Steps to Reproduce

• Break-glass to a PSC cluster - similar to a Privatelink cluster this will create a pod on the hive as only connections from hive IPs are accepted.

The cleanup command should delete this Pod again, but instead only prints the logs that it did unset the KUBECONFIG variable (non-privatelink behavior).

[RaphaelBut]

/fs-triage

[samanthajayasinghe]

/fs-triage

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 9:58 PM UTC · Completed 10:02 PM UTC
Commit: 13f62d5 · View workflow run →

[fullsend-ai-triage]

Triage Summary

Bug: The break-glass cleanup command does not recognize GCP PSC (Private Service Connect) clusters, leaving jump pods orphaned on hive.

Root Cause

In cmd/cluster/access/cleanup.go, the Run method only checks for AWS PrivateLink:

if cluster.AWS().PrivateLink() {
    return c.dropPrivateLinkAccess(cluster)
} else {
    return c.dropLocalAccess(cluster)
}

The access command (access.go) correctly handles PSC clusters with an additional check:

isPscCluster := cluster.GCP().PrivateServiceConnect().ServiceAttachmentSubnet() != ""
if cluster.AWS().PrivateLink() || isPscCluster { ... }

This mismatch means PSC clusters get jump pods created during break-glass but the cleanup path treats them as non-PrivateLink, only unsetting KUBECONFIG instead of deleting the pod.

Recommended Fix

1. Add the PSC check to cleanup.go's Run method to match access.go
2. Update the reason flag error message and description to reference PSC alongside PrivateLink
3. Update the command's Long description to mention PSC clusters

Proposed Test

// Extend generateClusterObjectForTesting to support PSC clusters,
// then add a test that verifies cleanup correctly deletes jump pods
// for a PSC cluster (same as the existing PrivateLink cleanup tests
// but with a GCP PSC cluster object).
cluster := generatePSCClusterObjectForTesting("psc-cluster", clusterid)
err := cleanupAccess.dropPrivateLinkAccess(&cluster)
// Assert no error, verify jump pods are deleted

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Code · ⚠️ Cancelled · Started 10:03 PM UTC · Ended 10:06 PM UTC
Commit: 13f62d5 · View workflow run →

[samanthajayasinghe]

/fs-code

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 10:07 PM UTC · Completed 10:31 PM UTC
Commit: 13f62d5 · View workflow run →