fix(gateway): give the spi-gateway Gateway a single Flux owner

[Copilot]

The spi-gateway Gateway was rendered by two Flux Kustomizations with different desired states: the profile-level spi-gateway (./software/components/gateway, HTTP:80 only) and the ingress-level spi-gateway-tls, whose overlay also pulls ../../components/gateway and adds HTTPS:443 plus spec.infrastructure.annotations. Both claimed the object in their inventories, each reconcile reverted the other, and the base version usually won, so spi-gateway-tls never went Ready and the route Kustomizations stayed blocked on it.

The selected ingress tree is now the Gateway's sole Flux owner.

Ownership

• Dropped the Layer 1d spi-gateway Kustomization from profiles/core and profiles/minimal.
• Renamed each ingress tree's spi-gateway-tls to spi-gateway. It points at the mode's TLS overlay, which already renders the complete object (base listeners, HTTPS listeners, Certificates, ReferenceGrant).
• ip and ip-minimal render ./software/components/gateway themselves, so every non-bare mode has exactly one renderer. bare still has none.

Ordering

The HTTPS listener needs a cert that needs an HTTP-01 challenge solved against HTTP:80 on the same Gateway. Applying both listeners in one shot keeps that workable: the HTTPS listener is simply unprogrammed until cert-manager finishes.

• spi-cert-manager-issuers no longer dependsOn: spi-gateway. Its ClusterIssuers reference the Gateway only from HTTP-01 solver parentRefs, resolved at challenge time, not at apply time.
• In the TLS modes spi-gateway now dependsOn: spi-cert-manager-issuers, so the ClusterIssuer exists before the overlay's Certificate lands.
• Route Kustomizations dependsOn: spi-gateway instead of spi-gateway-tls.

before:  spi-namespaces -> spi-gateway (profile)   -> spi-cert-manager-issuers -> spi-gateway-tls -> routes
                              \___ both render aks-istio-ingress/spi-gateway ___/

after:   spi-cert-manager -> spi-cert-manager-issuers -> spi-gateway (ingress, sole owner) -> routes

Tests

TestSingleRenderer in tests/test_profiles.py, parameterised over every profile/ingress-mode pair:

• test_no_object_is_rendered_twice walks the full kustomize resource graph of every declared Kustomization and fails when one object has more than one owner. Byte-identical copies rendered from separate files are exempt, which covers the deliberately duplicated bitnami HelmRepository under components/redis and components/external-dns.
• test_gateway_owner_is_the_ingress_tree pins the rule directly.

Docs

ADR-012 records the decision and the rejected shared-Gateway shape; ADR-007's layer table and the DAGs in deployment-lifecycle.md / flux-reconciliation.md drop spi-gateway from the profile; gateway-ingress.md describes the per-mode single-owner shape; ADR-025 carries a dated note that spi-gateway-tls was folded in. CHANGELOG entry under Fixed.

This fixes only the ownership half of azure-mode TLS. Whether spec.infrastructure.annotations has a Service to land on is the sibling ingress LoadBalancer issue and is untouched here.

• Fixes [bug] spi-gateway Gateway is claimed by two Flux Kustomizations #81

[Copilot]

Pull request overview

Moves Gateway ownership into the selected ingress tree to prevent competing Flux reconciliation.

Changes:

• Removes profile-level Gateway ownership and adds per-mode owners.
• Updates certificate and route dependencies.
• Adds ownership tests and documentation.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
tests/test_profiles.py	Adds single-renderer tests.
software/stacks/osdu/profiles/minimal/stack.yaml	Removes Gateway ownership.
software/stacks/osdu/profiles/core/stack.yaml	Removes Gateway ownership.
software/stacks/osdu/ingress/ip/stack.yaml	Adds the IP Gateway owner.
software/stacks/osdu/ingress/ip-minimal/stack.yaml	Adds minimal IP Gateway ownership.
software/stacks/osdu/ingress/ip-minimal/kustomization.yaml	Includes the new stack manifest.
software/stacks/osdu/ingress/dns/stack.yaml	Consolidates DNS Gateway ownership.
software/stacks/osdu/ingress/dns-minimal/stack.yaml	Consolidates minimal DNS ownership.
software/stacks/osdu/ingress/azure/stack.yaml	Consolidates Azure Gateway ownership.
software/stacks/osdu/ingress/azure-minimal/stack.yaml	Consolidates minimal Azure ownership.
docs/design/gateway-ingress.md	Documents per-mode ownership.
docs/design/flux-reconciliation.md	Updates reconciliation layering.
docs/design/deployment-lifecycle.md	Updates the profile DAG.
docs/decisions/025-tls-certificates-in-platform.md	Notes the ownership consolidation.
docs/decisions/012-ingress-profiles.md	Revises the ingress decision.
docs/decisions/007-layered-kustomization-ordering.md	Revises layer ownership.
CHANGELOG.md	Records the Gateway ownership fix.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[danielscholl]

Copilot Look at the comments and work toward resolving the issues noted.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated 6 comments.

[Copilot]

Copilot Look at the comments and work toward resolving the issues noted.

Addressed in c45a319 (plus formatter-only b94cec0). The handoff now preserves live Kustomization names, uses empty non-pruning orphan stubs for old inventories, removes duplicate Bitnami ownership, enforces strict single ownership, restores the accepted ADRs, and adds ADR-029. Full pre-commit validation and CodeQL pass.

[Copilot]

Pull request overview

Copilot reviewed 21 out of 21 changed files in this pull request and generated no new comments.

Suppressed comments (7)

Previously missed (2) — in code that hasn't changed since the last review.

tests/test_profiles.py:363

• The PR description says byte-identical copies are exempt, but this test and ADR-029:15-17 explicitly treat them as contested ownership; the ExternalDNS split also relies on the stricter rule. Update the PR description so reviewers and future release notes do not document the opposite invariant.

    Byte-identical desired state is still contested ownership: either
    Kustomization can delete the object from its inventory while pruning.

software/stacks/osdu/profiles/core/stack.yaml:148

• The PR description says the profile-level spi-gateway Kustomizations are dropped and TLS owners are renamed to spi-gateway, but the implementation deliberately retains the profile handoff plus the existing spi-gateway-tls names. Update the description to reflect this staged migration, since its stated ownership and rollout shape currently differs from the manifests and ADR-029.

# Temporary Gateway ownership handoff (ADR-029). This Kustomization must
# reconcile once with an empty inventory and pruning disabled before removal.

software/stacks/osdu/ingress/ip/stack.yaml:13

• Using a different owner name for IP mode makes the supported TLS-to-IP mode switch an unsafe inventory transfer. The top-level ingress Kustomization prunes the old tree (infra/flux.bicep:108-112), so deleting spi-gateway-tls with the default MirrorPrune policy can remove the Gateway after spi-gateway-ip adopts it, which is the race ADR-029:19-21 warns about. Keep one Kustomization identity across ingress modes, or add reciprocal non-pruning handoffs for mode changes.

  name: spi-gateway-ip

software/stacks/osdu/ingress/ip-minimal/stack.yaml:9

• Using a different owner name for IP mode makes the supported TLS-to-IP mode switch an unsafe inventory transfer. The top-level ingress Kustomization prunes the old tree (infra/flux.bicep:108-112), so deleting spi-gateway-tls with the default MirrorPrune policy can remove the Gateway after spi-gateway-ip adopts it, which is the race ADR-029:19-21 warns about. Keep one Kustomization identity across ingress modes, or add reciprocal non-pruning handoffs for mode changes.

  name: spi-gateway-ip

software/stacks/osdu/ingress/dns/stack.yaml:76

• This dependency gates ExternalDNS on the entire Redis Kustomization becoming Ready, although it only needs the Bitnami HelmRepository object that spi-redis applies. A Redis rollout failure now blocks ExternalDNS and both DNS-mode route Kustomizations even when Elasticsearch, Kibana, Airflow, and the shared source are healthy. Remove this gate and let the HelmRelease wait for its source, or introduce a dedicated shared-source Kustomization.

  dependsOn:
    - name: spi-redis

software/stacks/osdu/ingress/dns-minimal/stack.yaml:77

• This dependency gates ExternalDNS on the entire Redis Kustomization becoming Ready, although it only needs the Bitnami HelmRepository object that spi-redis applies. A Redis rollout failure now blocks ExternalDNS and the DNS-mode middleware routes even when Elasticsearch, Kibana, Airflow, and the shared source are healthy. Remove this gate and let the HelmRelease wait for its source, or introduce a dedicated shared-source Kustomization.

  dependsOn:
    - name: spi-redis

tests/test_profiles.py:372

• This traversal starts below each child Flux Kustomization, so it never records the child Kustomization objects rendered by the independent top-level stack and ingress reconcilers. If both trees declare the same child name, that object has two top-level inventory owners, but this test passes because the child is omitted and its payload owners collapse under the same dictionary key. Include each child Kustomization object with its top-level tree as owner before traversing spec.path.

        for item in _flux_kustomizations(tree):
            directory = REPO_ROOT / item["spec"]["path"].removeprefix("./")
            for path, doc in _built_resources(directory):

[danielscholl]

Copilot Six review comments from the 18:09 pass are still unresolved, and no commits have landed since b94cec0 (18:07:57), so none of them have been addressed yet. The five from the earlier 17:55 pass are resolved and verified; please leave those alone.

Two of these are hazards this fix introduced rather than pre-existing ones, so they matter most.

1. software/stacks/osdu/ingress/ip/stack.yaml:13 and ip-minimal/stack.yaml:9 — new owner name reintroduces the prune hazard

spi-gateway-ip is a different child identity from spi-gateway-tls. Switching --ingress-mode between a TLS mode and ip makes the top-level ingress Kustomization prune the old child, and its default MirrorPrune deletion can remove the shared Gateway even after the new owner has applied it. This is the same class of problem the orphan handoff was added to solve for the profile-level owner, just on the mode-switch path instead of the upgrade path.

Either use one owner identity across all non-bare ingress modes so a mode switch mutates the existing inventory, or apply the same explicit orphan handoff you used for spi-gateway. Whichever way, please make --ingress-mode switching in both directions safe for core and minimal.

2. software/stacks/osdu/ingress/dns/stack.yaml:76 and dns-minimal/stack.yaml:77 — ExternalDNS gated on full Redis readiness

Deleting the duplicate bitnami HelmRepository was right, but dependsOn on Redis over-couples the result: ExternalDNS only needs the HelmRepository, not a healthy Redis. If Redis's HelmRelease fails, ExternalDNS is never applied and both DNS route Kustomizations stay blocked even though Kibana and Airflow are fine.

Options the reviewer raised: drop the readiness dependency and let helm-controller retry until the source appears, or move the shared bitnami source into its own small Kustomization that both depend on. The second keeps an explicit ordering edge without tying ExternalDNS to Redis's runtime health.

3. tests/test_profiles.py:379 — the guard has a blind spot

_renderings() walks each child Kustomization's spec.path but never records the Flux Kustomization documents rendered directly by the top-level stack and ingress trees. If both trees declared the same Kustomization identity, their root inventories would contest it and test_no_object_is_rendered_twice would still pass.

This one matters beyond tidiness: this test is the regression guard for #81, and right now it cannot see the root-level case. Please record each item itself under a root-owner key before walking its managed resources, and add a case that fails without the fix.

4. docs/decisions/029-single-flux-inventory-owner.md:47 — PR description no longer matches the implementation

The description still says TLS owners are renamed to spi-gateway and that routes depend on that name, and it references a test exemption. The implementation deliberately kept spi-gateway-tls, introduced spi-gateway-ip, and carries no exemption. Please update the PR body so the rollout plan and ADR references match what the branch actually does.

Also

CI has not run on this branch. gh pr checks 84 reports only license/cla (no lint, typecheck, manifests, or test job), so the new tests in TestSingleRenderer are unverified. Please confirm uv run pre-commit run --all-files passes locally with your changes.

Scope note: this PR closes #81 only. #82 (the DNS label having no Service to land on) is tracked separately, so no need to pull it in here.

[Copilot]

Copilot Six review comments from the 18:09 pass are still unresolved, and no commits have landed since b94cec0 (18:07:57), so none of them have been addressed yet. The five from the earlier 17:55 p...

All four are addressed in the latest commit; uv run pre-commit run --all-files passes locally (ruff check, ruff format, ty, pytest, 81 tests in tests/test_profiles.py), and kustomize build succeeds for every changed tree.

1. Mode-switch prune hazard. Took the "one owner identity" option. Every non-bare mode now declares the Gateway owner as spi-gateway-tls, the name the TLS modes already carry on live clusters, so switching --ingress-mode in either direction only rewrites spec.path on the existing inventory: ./software/overlays/gateway-tls-{single,multi}-host for the TLS modes, ./software/components/gateway for ip. No child is pruned, so no MirrorPrune deletion of the Gateway. The ip comments say why the name is shared, and ADR-029 notes the name can be shortened to spi-gateway in a later rollout, once the profile-level handoff is gone and the rename can carry its own handoff.

2. ExternalDNS gated on Redis. Took the second option. The bitnami HelmRepository moved out of software/components/redis into software/components/helm-sources, owned by a new spi-helm-sources Kustomization at layer 1 (dependsOn: spi-namespaces). spi-redis and spi-external-dns-release both depend on it, so ExternalDNS keeps an explicit ordering edge to the source it needs and no longer waits on Redis's HelmRelease health. spi-redis depending on spi-helm-sources also orders the handoff: the new owner adopts the HelmRepository before the old owner reconciles without it, and Flux skips pruning objects whose ownership labels now point elsewhere.

3. Test blind spot. _renderings now records two levels: each Flux Kustomization document under a root-owner key for its tree (<core tree>, <dns tree>), then the resources its spec.path builds. Two trees declaring one Kustomization identity is now contested. test_two_trees_declaring_one_kustomization_are_contested builds exactly that case from two temp trees and asserts the contested entry; it returns {} and fails without the root-level record. Also added test_gateway_owner_name_is_shared_by_every_mode, which pins item 1.

4. PR description. Rewritten to match the branch: shared spi-gateway-tls identity rather than a rename to spi-gateway, no spi-gateway-ip, no test exemption, plus the orphan handoffs and the spi-helm-sources move.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 23 out of 24 changed files in this pull request and generated no new comments.

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

docs/design/gateway-ingress.md:75

• The shared child identity described here contradicts the mode-switch procedure at line 95, which still says the old mode's Kustomization and all of its resources are pruned. spi-gateway-tls and the route children are now updated in place; only children absent from the new tree are pruned. Update that step so operators do not expect the Gateway to be deleted during a mode switch.

- `spi-gateway-tls`, rendering `software/components/gateway` unmodified: HTTP:80 and nothing else. The name is shared with the TLS modes so a mode switch keeps one Flux inventory (ADR-029).

docs/design/flux-reconciliation.md:154

• spi-gateway-tls cannot fix a missing Istio DestinationRule CRD: the Gateway owner only applies Gateway, Certificate, and ReferenceGrant resources, while the AKS managed Istio extension registers the Istio CRDs. This troubleshooting step sends the operator to an unrelated Kustomization; direct them to the extension for a missing CRD, or to the manifest when the namespace is wrong.

The Istio CRD has not registered yet, or the namespace is wrong. `kubectl get crd | grep istio` confirms. Fix the upstream Gateway owner (`spi-gateway-tls`, declared by the selected ingress tree) or the AKS Istio extension, reconcile, and the chain unblocks layer by layer.