Skip to content

fix(ctf): scale event egress without per-range routers - #2381

Merged
Brad-Edwards merged 13 commits into
devfrom
2372-ctf-shared-egress
Sep 26, 2026
Merged

Brad-Edwards merged 13 commits into
devfrom
2372-ctf-shared-egress

Conversation

@Brad-Edwards

Copy link
Copy Markdown
Owner

Summary

CTF launches now pin the event workspace's egress policy without changing participant range ownership. Shared-VPC GCP ranges use serialized, explicitly scoped regional NAT capacity instead of a router per range.

Requirement UIDs

  • (none — bug/refactor/maintenance run; see Traceability section below)

Related Issues

Closes #2372

ADR Impact

  • ADR-017
  • ADR-021
  • ADR-026
  • ADR-046
  • ADR-056

Changes

  • Carry and authorize the event policy workspace through participant, spare, recovery, and CMS reservation paths; reject incompatible spare reuse and warm claims.
  • Allocate, reconcile, and remove explicit shared NAT subnet memberships under a regional lock, with bounded capacity and migration-bridge replay safety.
  • Document capacity, policy/audit behavior, and migration ownership; align the binding ADR rules.

Test Plan

  • Unit tests pass
  • Integration tests pass if applicable
  • Full completion suite required in CI before merge
  • No coverage regression

Targeted platform and GCP suites, import boundaries, Ruff, and ADR guard passed locally; hosted CI remains the delivery gate.

Ground Control Checks

  • Repository policy checks required in CI before merge
  • Pre-push Codex review completed; all findings fixed or dispositioned

Traceability

  • IMPLEMENTS: PLAT-238 ← shifter/engine/provisioner/gcp_range_cell_shared_nat.py
  • TESTS: PLAT-238 ← shifter/engine/provisioner/tests/test_gcp_shared_nat.py

Checklist

  • Code follows the project's coding standards
  • Changelog: owned by Release Please (generated from the Conventional Commit PR title; no per-PR fragment)
  • Architectural docs updated if stack, package structure, or key behaviors changed

Documentation

Updated: see diff.

@Brad-Edwards

Copy link
Copy Markdown
Owner Author

Ground Control delivery — this pull request delivers issue #2372; Phase E runs on merge.

# Conflicts:
#	shifter/engine/provisioner/gcp_range_cells.py
Merge the shared-NAT and missing-router_nat early exits into a single guard so
_ensure_router_nat has three returns instead of four (Sonar S1142). Behavior is
unchanged: a shared-NAT range still calls ensure_shared_nat and returns False,
and a zero-egress range still returns False without creating a router.
@Brad-Edwards
Brad-Edwards merged commit b7c40dd into dev Sep 26, 2026
7 checks passed
@Brad-Edwards
Brad-Edwards deleted the 2372-ctf-shared-egress branch September 26, 2026 21:40
@sonarqubecloud

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant