fix(#943): handle GCP PSC clusters in break-glass cleanup

[fullsend-ai-coder]

Summary

• Add GCP Private Service Connect (PSC) cluster detection to the break-glass cleanup command, matching the existing logic in the access command
• PSC clusters now correctly route to dropPrivateLinkAccess to delete jump pods on hive instead of only unsetting KUBECONFIG
• Update command descriptions, error messages, and log output to reference PSC alongside PrivateLink

Root Cause

The cleanup.go Run method only checked cluster.AWS().PrivateLink() to decide whether to delete jump pods. The access.go Run method additionally checks cluster.GCP().PrivateServiceConnect().ServiceAttachmentSubnet() != "" for PSC clusters. This mismatch meant PSC clusters got jump pods created during break-glass but cleanup treated them as non-PrivateLink, leaving orphaned pods on hive.

Changes

• cmd/cluster/access/cleanup.go: Added PSC check (isPscCluster) to the Run method, updated Long description, reason flag help text, error/log messages in dropPrivateLinkAccess, and fixed pre-existing typo and unnecessary fmt.Sprintf on touched lines
• cmd/cluster/access/access_test.go: Added generatePSCClusterObjectForTesting helper function
• cmd/cluster/access/cleanup_test.go: Added TestCleanupAccessOptions_dropPrivateLinkAccess_PSCCluster test suite covering single pod, no pods, and mixed pod scenarios

Testing

• All existing PrivateLink cleanup tests pass
• New PSC cleanup tests pass (3 sub-cases: single jump pod, no pods, mixed pods)
• go vet and golangci-lint pass with zero issues

---

Closes #943

Post-script verification

• Branch is not main/master (agent/943-psc-cleanup-fix)
• Secret scan passed (gitleaks — 13f62d5fbd5f130e861aa956a4709499d18144e9..HEAD)
• PR body secret scan passed (gitleaks — no-git)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: fullsend-ai-coder[bot]
Once this PR has been reviewed and has the lgtm label, please assign makdaam for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

Hi @fullsend-ai-coder[bot]. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[samanthajayasinghe]

/ok-to-test

[openshift-ci]

@fullsend-ai-coder[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-docs	b45725c	link	true	/test verify-docs

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.