fix(server): use the shared regional gateway for bare-metal Kura regions

What

On bare-metal (host-network) Kura regions, stop minting a per-account dedicated gateway. gateway_assignment now returns nil when the region’s gateway is :host_network, so every account uses the region’s shared ingress class, served by the platform gateway. Dedicated gateways are unchanged on LoadBalancer regions.

Why

A host-network region’s ingress is a single host-network gateway bound to the box’s :80/:443 — a per-node DaemonSet (platform-kura-<region>-ingress-nginx-controller) deployed by the platform chart, serving the region’s shared class (kura-<region>).

But the server also creates a per-account dedicated host-network gateway for accounts flagged dedicated_gateway? (the kura_dedicated_gateway_account_handles env allowlist or the :dedicated_kura_gateway entitlement). Two host-network ingress-nginx controllers cannot both bind :443 on the same box. Observed live on prod eu-central after the toleration fix (#11599) let the dedicated gateway past the node taint:

platform  platform-kura-eu-central-ingress-nginx-controller   1/1 Running (holds :443 on the box)
kura      kgw-799b0dea3467-eu-central-controller              0/1 Pending  -- "no free ports for the requested pod ports"

The dedicated gateway sits unschedulable, and the account’s KuraInstance — pinned to the dedicated ingress class (kura-eu-central-kgw-...) rather than the shared kura-eu-central — never serves, even though the shared platform gateway is healthy.

This is a cloud-LB-era assumption: on LoadBalancer regions each dedicated account got its own LB, so N per-account gateways were free. On a single host-network box they collide on the port. Account isolation on bare metal is a dedicated box, not a dedicated gateway.

How

gateway_assignment gains and not gateway_host_network?(region). With gateway = nil, the instance manifest’s ingressClassName falls through to the region’s shared class (ingress_class_name/2), and no KuraGateway CR / tuist.dev/kura-gateway annotation is produced. This also removes the replicas: 2 host-network over-provision (that was the dedicated Deployment; the platform gateway is already a per-node DaemonSet).

Case coverage:

• host-network + dedicated account → shared class (the fix)
• LoadBalancer + dedicated account → dedicated gateway (unchanged)
• non-dedicated account / private region → unchanged

Validation

Added a test: a dedicated account on a host-network region gets ingressClassName == "kura-us-east" and no tuist.dev/kura-gateway annotation. Existing dedicated-gateway (LB) and host-network gateway tests still assert the prior behavior. mix test test/tuist/kura/provisioner/kubernetes_controller_test.exs (running).

Rollout note

An already-provisioned instance on a host-network region keeps its dedicated class until it re-rolls (the @manifest_revision skip — converged instances don’t re-apply). A dashboard Destroy → Deploy re-renders it onto the shared class and cleans up the orphaned Pending dedicated gateway CR. This is the last step to make prod eu-central actually serve.

🤖 Generated with Claude Code

No GitHub comments yet.