refactor(deployment): entity grouping, Fargate CDK fleet, EC2 package split - #4410
Open
davincios wants to merge 32 commits into
Open
refactor(deployment): entity grouping, Fargate CDK fleet, EC2 package split#4410davincios wants to merge 32 commits into
davincios wants to merge 32 commits into
Conversation
Reorganize deployment into platform/deployment_fargate and platform/deployment_ec2, add a Python CDK shared Fargate fleet stack, and remove the legacy ecr_deploy/GHCR publish paths. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
|
Too many files changed for review. ( Bypass the limit by tagging |
Contributor
Greptile code reviewThis repo uses Greptile for automated review. Before merge, aim for Confidence Score: 5/5 with zero unresolved review threads — see CONTRIBUTING.md. Run a review — add a PR comment with: Give it ~5-10 minutes (sometimes longer) for results, then fix feedback and re-trigger until you reach Confidence Score: 5/5. Optional: automate with the greploop skill. |
Keep the Fargate/EC2 package split and dropped ecr_deploy path while preserving main's webapp harness registration and store path hardening. Co-authored-by: Cursor <cursoragent@cursor.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
CodeQL found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.
![github-code-quality[bot]](https://avatars.githubusercontent.com/u/9919?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
This PR restructures OpenSRE’s deployment code by separating EC2 gateway primitives from the new multi-tenant Fargate control-plane/public API, adds a shared CDK “fleet” stack, and updates tests/docs/CI to match the new deployment entity boundaries.
Changes:
- Split deployment code into
platform/deployment_fargate/(control plane + public API + fleet IaC + gateway lifecycle) andplatform/deployment_ec2/(EC2 boto3 helpers). - Add a Python CDK app + synth assertions for shared Fargate fleet resources and wire new
make cdk-*targets. - Add credential hydration + concurrency/readiness primitives for the gateway runtime; remove legacy Docker/ECR deploy and GHCR publish workflow.
Reviewed changes
Copilot reviewed 124 out of 138 changed files in this pull request and generated 7 comments.
Show a summary per file
| File | Description |
|---|---|
| tests/platform/deployment/test_stack_namespace.py | Removed legacy ECR deploy stack namespace tests. |
| tests/platform/deployment/test_image_build.py | Removed legacy ECR image build tests. |
| tests/platform/deployment/test_ec2_instance.py | Removed legacy EC2 deploy (Docker/ECR) instance tests. |
| tests/platform/deployment/test_ec2_deploy.py | Removed legacy EC2 deploy (Docker/ECR) lifecycle tests. |
| tests/platform/deployment/test_destroy_ecr_retention.py | Removed legacy ECR retention tests. |
| tests/platform/deployment/test_deploy_guard.py | Removed legacy deploy guard tests for ECR path. |
| tests/platform/deployment_fargate/test_ec2_stack_instances.py | Updated EC2 helper import paths to platform.deployment_ec2. |
| tests/platform/deployment_fargate/test_ec2_security_group.py | Updated EC2 SG helper import paths to platform.deployment_ec2. |
| tests/platform/deployment_fargate/test_ec2_launch_instance.py | Updated EC2 launch helper import paths to platform.deployment_ec2. |
| tests/platform/deployment_fargate/test_deployment_health.py | Updated health polling import path to the new shared helper. |
| tests/platform/deployment_fargate/test_deploy_env_validation.py | Updated deploy env validation import path after refactor. |
| tests/platform/deployment_fargate/test_deploy_account_guard.py | Updated deploy-account guard import paths to platform.deployment_ec2. |
| tests/platform/deployment_fargate/test_aws_urls.py | Added tests for AWS console URL builders. |
| tests/platform/deployment_fargate/fargate_fleet_infrastructure/test_fargate_fleet_stack.py | Added CDK synth/assertion tests for the shared fleet stack. |
| tests/platform/deployment_fargate/fargate_fleet_infrastructure/init.py | Added package marker for fleet infrastructure tests. |
| tests/platform/deployment_fargate/deploy_gateway/test_provision.py | Updated gateway provision tests to new module paths. |
| tests/platform/deployment_fargate/deploy_gateway/test_lifecycle.py | Updated gateway lifecycle tests to new module paths/config. |
| tests/platform/deployment_fargate/deploy_gateway/test_direct_deploy.py | Updated gateway direct-deploy tests to new module paths/config. |
| tests/platform/deployment_fargate/deploy_gateway/test_bake.py | Updated gateway AMI bake tests to new module paths/config. |
| tests/platform/deployment_fargate/deploy_gateway/init.py | Added package marker for gateway deploy tests. |
| tests/platform/deployment_fargate/conftest.py | Added autouse fixture to disable account guard for deployment tests. |
| tests/integrations/test_store.py | Added coverage for atomic v2 store replacement and directory permissions. |
| tests/integrations/test_remote_credential_hydration.py | Added tests for credentials API validation + atomic local materialization. |
| tests/e2e/deploy/test_health_endpoint.py | Updated health polling import path to shared helper. |
| tests/deployment/ec2/test_gateway_e2e.py | Removed legacy EC2 Docker/ECR e2e deploy test. |
| tests/deployment/ec2/conftest.py | Removed legacy EC2 Docker/ECR e2e deploy fixtures. |
| tests/deployment/control_plane/test_s3files_live.py | Added opt-in live-AWS harness tests for S3 Files isolation behavior. |
| tests/deployment/control_plane/test_image_contract.py | Added image contract tests (currently inconsistent with refactor module layout). |
| tests/deployment/control_plane/test_api/test_contracts.py | Added contract tests for control-plane records. |
| tests/deployment/control_plane/test_api/test_bootstrap.py | Added SDK bootstrap tests (currently inconsistent with refactor module layout). |
| tests/deployment/control_plane/test_api/test_authorizer.py | Added authorizer tests for control-plane/public API boundaries. |
| tests/deployment/control_plane/test_api/init.py | Added package marker for control-plane API tests. |
| tests/deployment/control_plane/init.py | Added package marker for control-plane test area. |
| README.md | Updated top-level deployment guidance to remove legacy Docker/ECR EC2 path. |
| pyproject.toml | Added cdk optional dependency extra. |
| platform/README.md | Updated platform map to reflect new deployment packages + Cloudflare worker. |
| platform/deployment/README.md | Removed legacy deployment package documentation. |
| platform/deployment/ecr_deploy/stack.py | Removed legacy ECR deploy stack configuration/outputs code. |
| platform/deployment/ecr_deploy/init.py | Removed legacy ECR deploy package marker. |
| platform/deployment/aws/ecr.py | Removed legacy ECR build/push helper. |
| platform/deployment/aws/init.py | Removed legacy deployment aws package marker. |
| platform/deployment/init.py | Removed legacy deployment package marker. |
| platform/deployment_fargate/utils/health_poll.py | Added shared HTTP health polling helper for deployment readiness checks. |
| platform/deployment_fargate/utils/init.py | Added package marker for deployment-fargate utils. |
| platform/deployment_fargate/README.md | Added documentation for the new deployment-fargate entity layout + commands. |
| platform/deployment_fargate/http_lambda.py | Added shared Lambda HTTP parsing/validation/response helpers. |
| platform/deployment_fargate/gateway/systemd/opensre-gateway.service | Added systemd unit for EC2 gateway runtime. |
| platform/deployment_fargate/gateway/stack.py | Added gateway stack naming + persisted output/AMI ID state. |
| platform/deployment_fargate/gateway/README.md | Updated gateway deploy docs to new module paths and scope. |
| platform/deployment_fargate/gateway/provision.py | Updated provisioning to use platform.deployment_ec2 primitives. |
| platform/deployment_fargate/gateway/lifecycle.py | Updated gateway lifecycle wiring to new module paths and prep utilities. |
| platform/deployment_fargate/gateway/direct_deploy.py | Updated direct deploy to use platform.deployment_ec2 primitives. |
| platform/deployment_fargate/gateway/bake.py | Updated AMI baking to use platform.deployment_ec2 primitives. |
| platform/deployment_fargate/gateway/init.py | Added package marker (docstring currently contradicts Telegram-only scope). |
| platform/deployment_fargate/fargate_fleet_infrastructure/README.md | Added shared fleet CDK docs (contains a likely typo in the CDK CLI version). |
| platform/deployment_fargate/fargate_fleet_infrastructure/cdk.json | Added CDK app entry configuration and watch excludes. |
| platform/deployment_fargate/fargate_fleet_infrastructure/app.py | Added CDK app entrypoint to synthesize the shared fleet stack. |
| platform/deployment_fargate/fargate_fleet_infrastructure/init.py | Added package marker for fleet infrastructure code. |
| platform/deployment_fargate/api_public_forwarder/routing/init.py | Added placeholder package for future public API routing. |
| platform/deployment_fargate/api_public_forwarder/handler.py | Added public /v1/runs Lambda handler (currently imports non-existent package paths). |
| platform/deployment_fargate/api_public_forwarder/authorizer.py | Added bearer authorizer (currently imports non-existent package paths). |
| platform/deployment_fargate/api_public_forwarder/init.py | Added package exports (currently references non-existent package paths). |
| platform/deployment_fargate/api_control_plane/verification/setup_task.py | Added safe “setup task” for disposable S3 Files credential tests. |
| platform/deployment_fargate/api_control_plane/verification/init.py | Added package marker for control-plane verification helpers. |
| platform/deployment_fargate/api_control_plane/store/init.py | Added package marker for control-plane persistence layer. |
| platform/deployment_fargate/api_control_plane/reconciler/results.py | Added typed lifecycle result containers. |
| platform/deployment_fargate/api_control_plane/reconciler/errors.py | Added safe external lifecycle errors with stable error codes. |
| platform/deployment_fargate/api_control_plane/reconciler/config.py | Added tenant fleet config loader from environment. |
| platform/deployment_fargate/api_control_plane/contracts/lifecycle_service.py | Added protocol for lifecycle service boundary. |
| platform/deployment_fargate/api_control_plane/contracts/contracts.py | Added control-plane domain records + persistence ports. |
| platform/deployment_fargate/api_control_plane/contracts/init.py | Added re-export surface for control-plane contracts. |
| platform/deployment_fargate/api_control_plane/aws_adapters/types.py | Added typed protocol boundaries for boto3 clients and tag helpers. |
| platform/deployment_fargate/api_control_plane/aws_adapters/secrets.py | Added Secrets Manager adapter for bootstrap + public API credentials. |
| platform/deployment_fargate/api_control_plane/aws_adapters/s3_files.py | Added S3 Files adapter for filesystem/access points/policies. |
| platform/deployment_fargate/api_control_plane/aws_adapters/iam.py | Added IAM policy builders and tenant task role adapter. |
| platform/deployment_fargate/api_control_plane/aws_adapters/get_boto3_client.py | Added boto3 client factory with standard timeouts/retries. |
| platform/deployment_fargate/api_control_plane/api/iam_auth.py | Added IAM principal allowlist helper for lifecycle routes. |
| platform/deployment_fargate/api_control_plane/api/handler.py | Added lifecycle route handler for control-plane API. |
| platform/deployment_fargate/api_control_plane/api/init.py | Added exports for control-plane API surfaces. |
| platform/deployment_fargate/api_control_plane/init.py | Added exports for control-plane entity package. |
| platform/deployment_fargate/init.py | Added top-level package marker for deployment-fargate. |
| platform/deployment_ec2/ssm.py | Updated imports to new deployment-ec2 module layout. |
| platform/deployment_ec2/ec2.py | Updated imports and internal references to new deployment-ec2 module layout. |
| platform/deployment_ec2/config.py | Removed ECR/Docker constants; focused on EC2+SSM gateway deployment. |
| platform/deployment_ec2/client.py | Updated imports to reference new deployment-ec2 config module. |
| platform/deployment_ec2/init.py | Added package marker for deployment-ec2. |
| platform/cloudflare_install_proxy/wrangler.jsonc | Added Wrangler config for the Cloudflare install proxy worker. |
| platform/cloudflare_install_proxy/src/index.mjs | Updated install proxy User-Agent for clearer identification. |
| platform/cloudflare_install_proxy/README.md | Updated Cloudflare worker docs for the new path/name. |
| Makefile | Removed legacy ECR deploy targets; added cdk-* targets; updated gateway lifecycle entrypoints. |
| integrations/store.py | Hardened store directory permissions; added atomic replace helper. |
| integrations/credentials_api/client.py | Added strict credentials API client + v2 store validation/hydration. |
| integrations/credentials_api/init.py | Added exports for credentials API client and contracts. |
| gateway/tests/runtime/test_remote_run_worker.py | Added tests for durable API-run worker behavior. |
| gateway/tests/runtime/test_credential_hydration.py | Added tests for fail-closed credential hydration at startup. |
| gateway/tests/runtime/test_concurrency_gate.py | Added tests for shared capacity gate behavior. |
| gateway/runtime/scheduler_concurrency.py | Added wrapper to gate scheduler runners with the same concurrency semaphore. |
| gateway/runtime/readiness.py | Added process-local readiness flag. |
| gateway/runtime/credential_hydration.py | Added startup hydrator wiring credentials API + Secrets Manager bootstrap. |
| gateway/runtime/concurrency.py | Added shared non-blocking concurrency gate for gateway turns (currently imports non-existent package paths). |
| gateway/http/webapp.py | Added /readyz readiness endpoint backed by new readiness state. |
| docs/messaging/telegram.mdx | Updated deployment instructions to reference make deploy-gateway. |
| docs/messaging/slack.mdx | Updated slack docs to reflect Telegram-only EC2 gateway path. |
| docs/DEVELOPMENT.md | Updated quick reference deployment commands (removed legacy ECR path). |
| docs/deployment.mdx | Removed GHCR prebuilt image section (workflow removed). |
| Dockerfile | Added runtime utilities (bash/curl/ca-certs) and removed legacy EC2 deploy comment. |
| DEPLOYMENT.md | Reworked deployment doc for gateway-only EC2 and added CDK fleet section (contains likely CDK CLI version typo). |
| config/remote_store.py | Updated layering note to reference platform/deployment_fargate/. |
| AGENTS.md | Updated repo map to mention platform/deployment_fargate/ + platform/deployment_ec2/. |
| .github/workflows/release.yml | Updated paths-ignore for renamed Cloudflare worker directory. |
| .github/workflows/docker-publish.yml | Removed GHCR docker-publish workflow. |
| .github/workflows/ci.yml | Updated workflow path filters and coverage targets for new deployment packages. |
| .github/workflows/ci-labels-windows.yml | Updated coverage targets for new deployment packages. |
| .github/workflows/benchmark-image.yml | Updated path filter for renamed deployment package. |
| .github/ci/test_scope_rules.py | Updated test-scope rules for new deployment package structure. |
| .env.fargate-fleet.example | Added example env mapping CDK outputs to TenantFleetConfig. |
| .env.deploy.example | Updated minimal env template for gateway-only EC2 deploy and added CDK notes. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+9
to
+23
| from platform.deployment_fargate.control_plane.contracts.contracts import ( | ||
| AgentRun, | ||
| AgentRunRepository, | ||
| AgentRunSource, | ||
| ) | ||
| from platform.deployment_fargate.http_lambda import ( | ||
| ClientRequestError, | ||
| json_body, | ||
| method_and_path, | ||
| organization_id_pattern, | ||
| response, | ||
| run_id_pattern, | ||
| ) | ||
| from platform.deployment_fargate.public_api.authorizer import AuthorizedTenant | ||
|
|
Comment on lines
+3
to
+10
| from platform.deployment_fargate.public_api.authorizer import ( | ||
| AuthorizedTenant, | ||
| AwsSecretsManagerReader, | ||
| BearerAuthorizer, | ||
| SecretReader, | ||
| ) | ||
| from platform.deployment_fargate.public_api.handler import PublicApiHandler | ||
|
|
Comment on lines
+24
to
+25
| from platform.deployment_fargate.public_api.authorizer import AwsSecretsManagerReader, BearerAuthorizer | ||
| from platform.deployment_fargate.public_api.handler import PublicApiHandler |
Comment on lines
+9
to
+12
| from core.agent_harness.session import SessionCore | ||
| from gateway.runtime.sink_protocol import GatewayAgentCallback, GatewaySink | ||
| from platform.deployment_fargate.control_plane.contracts import SizeProfile | ||
|
|
Comment on lines
+7
to
+11
| from platform.deployment_fargate.control_plane.build.images import ( | ||
| CONTROL_PLANE_LAMBDA, | ||
| GATEWAY_IMAGE, | ||
| require_immutable_ecr_image, | ||
| ) |
Correct leftover control_plane/public_api import paths after the entity rename, and satisfy ruff/mypy for the Fargate CDK stack. Co-authored-by: Cursor <cursoragent@cursor.com>
Rename api_control_plane/build to image_contracts so it is not gitignored, and tell mypy to ignore aws_cdk/constructs without the cdk extra. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 131 out of 145 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (6)
platform/deployment_fargate/api_control_plane/reconciler/config.py:52
OPENSRE_FARGATE_RESOURCE_PREFIXis.strip()’d, but if a user sets it to only whitespace the resulting empty prefix will produce invalid AWS resource names (e.g. leading “-” in task families/services). Also, treat a blankOPENSRE_CREDENTIALS_API_URLas “unset” instead of propagating an empty string.
platform/deployment_fargate/api_control_plane/reconciler/config.py:20TenantFleetConfig.credentials_api_urlis treated as optional elsewhere (it may be empty/omitted), but the dataclass type isstr, which makes it look required and encourages passing empty strings around. Consider making it explicitly optional (str | None) so call sites can distinguish “unset” from “set to empty”.
This issue also appears on line 29 of the same file.
platform/README.md:19
- This README points to
deployment/owning EC2 provisioning, butplatform/deployment/no longer exists after this refactor. Updating these bullets to the newdeployment_fargate/anddeployment_ec2/packages will keep the platform map accurate.
README.md:175 - The heading says “Two primary AWS EC2 paths”, but only one EC2 path is listed here. Either adjust the wording or add the second EC2 option (e.g. the direct SSM deploy target) so the summary matches the available Makefile targets.
Two primary AWS EC2 paths and a general hosted option:
- **Gateway (AMI + systemd):** `make bake-gateway` then `make deploy-gateway` — Telegram gateway on EC2, baked into a custom AMI.
- **Hosted (Railway / ECS / Vercel):** deploy with the repo `Dockerfile`; set `LLM_PROVIDER` and the matching API key (see [`.env.example`](.env.example)), plus `DATABASE_URI` and `REDIS_URI` if persistence is needed.
platform/deployment_fargate/fargate_fleet_infrastructure/README.md:30
- This section says
CredentialsApiUrlis something the user “must supply”, but the CDK stack definesCredentialsApiUrlwith a default empty string (i.e. optional). The docs should reflect whether the parameter is actually required or optional to avoid confusing deploy instructions.
platform/deployment_fargate/README.md:78 - The EC2 gateway prerequisites section links to
aws/config.py, but EC2 constants now live underplatform/deployment_ec2/config.py. The link/path should be updated so readers can find the actual region default.
Keep shared request/response helpers with the other Fargate deployment utilities used by the control-plane and public API handlers. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 131 out of 145 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
gateway/http/webapp.py:115
readyz()hardcodes status codes (200/503) even though this module already usesfastapi.statusconstants for the other health routes. Using the shared constants keeps conventions consistent and avoids magic numbers.
"""Report mandatory startup readiness separately from process liveness."""
if is_gateway_ready():
return JSONResponse({"status": "ready"}, status_code=200)
return JSONResponse({"status": "not_ready"}, status_code=503)
gateway/http/webapp.py:115
- A new
/readyzendpoint was added, but there’s no test coverage for its ready/not-ready behavior alongside the existing/okroute tests. Adding a small FastAPI TestClient test would help prevent regressions (especially aroundGatewayManagertoggling readiness).
This issue also appears on line 112 of the same file.
@app.get("/readyz")
def readyz() -> JSONResponse:
"""Report mandatory startup readiness separately from process liveness."""
if is_gateway_ready():
return JSONResponse({"status": "ready"}, status_code=200)
return JSONResponse({"status": "not_ready"}, status_code=503)
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 131 out of 145 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
platform/deployment_fargate/api_control_plane/reconciler/config.py:48
OPENSRE_FARGATE_RESOURCE_PREFIXis treated as optional, but if it's set to whitespace/empty the.strip()result becomes an empty prefix, which then produces invalid AWS resource names like-<org>-gateway. Treat blank values as the default (or fail fast).
README.md:172- This section says “Two primary AWS EC2 paths…”, but only one EC2 path is listed (gateway AMI + systemd). Update the wording so it matches the bullets.
Two primary AWS EC2 paths and a general hosted option:
The routing package was only a future-webhook stub; /v1/runs dispatch already lives in api_public_forwarder.handler. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 130 out of 144 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (1)
platform/deployment_fargate/api_control_plane/aws_adapters/ecs.py:13
_IMMUTABLE_IMAGEaccepts any<registry>/<repo>@sha256:...reference (it even allows:in the repository), but the error message says this must be an ECR digest. As written, a public registry image digest would pass validation, which weakens the supply-chain boundary for tenant task definitions.
Split lifecycle operations into explicit method modules and consolidate runtime wiring so tenant-scoped deployment behavior is easier to maintain. Co-authored-by: Cursor <cursoragent@cursor.com>
|
|
||
|
|
||
| class EcsClient(Protocol): | ||
| def register_task_definition(self, **kwargs: Any) -> dict[str, Any]: ... |
| class EcsClient(Protocol): | ||
| def register_task_definition(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def create_service(self, **kwargs: Any) -> dict[str, Any]: ... |
|
|
||
| def create_service(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def update_service(self, **kwargs: Any) -> dict[str, Any]: ... |
|
|
||
| def update_service(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def describe_services(self, **kwargs: Any) -> dict[str, Any]: ... |
|
|
||
| def describe_services(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def describe_task_definition(self, **kwargs: Any) -> dict[str, Any]: ... |
|
|
||
| def describe_task_definition(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def delete_service(self, **kwargs: Any) -> dict[str, Any]: ... |
|
|
||
| def delete_service(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def deregister_task_definition(self, **kwargs: Any) -> dict[str, Any]: ... |
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 139 out of 149 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (4)
platform/deployment_fargate/api_control_plane/utils/s3files_definition.py:108
- The
environmentextraction assumes every entry incontainer["environment"]is a mapping; malformed entries will raiseAttributeErrorduring.get(...). Since this is a contract validator, it should fail with a clearValueErrorinstead of throwing.
platform/deployment_fargate/api_control_plane/utils/s3files_definition.py:90 validate_task_definition()assumes everycontainerDefinitionsentry is a mapping and calls.get(...)unconditionally. If the task definition shape is malformed (or comes from an unexpected source), this will raiseAttributeErrorinstead of a controlledValueErrorfrom this validation function.
This issue also appears on line 106 of the same file.
platform/deployment_fargate/api_control_plane/utils/s3files_definition.py:12
WORKSPACE_VOLUME_NAMEis set to"tenant-workspace", but the production ECS task-definition builder uses"workspace"as the volume/mount name (seeplatform/deployment_fargate/api_control_plane/aws/ecs.py). This makes the validator + its tests diverge from the actual task definition shape and risks future false positives/negatives when wiring validation into lifecycle code.
platform/deployment_fargate/api_control_plane/utils/get_fleet_config.py:52TenantFleetConfig.from_environment()allowsOPENSRE_CREDENTIALS_API_URLto be set to a non-HTTPS URL. The Gateway hydrator later rejects non-HTTPS URLs and will fail closed at runtime; validating HTTPS here makes misconfiguration fail fast at control-plane boot instead of after a deployment.
|
|
||
| from platform.deployment_fargate.api_control_plane.aws.tags import resource_tags | ||
|
|
||
| _IMMUTABLE_IMAGE = re.compile(r"^[a-zA-Z0-9][a-zA-Z0-9._:/-]*@sha256:[0-9a-f]{64}$") |
Add independently deployable control-plane and public-forwarder infrastructure so fleet outputs, database migration, permissions, monitoring, and HTTP routes are managed consistently. Co-authored-by: Cursor <cursoragent@cursor.com>
Resolve shared memories infrastructure identifiers from the external Terraform stack so Fargate deployments attach the required S3 Files client security group consistently. Co-authored-by: Cursor <cursoragent@cursor.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 171 out of 182 changed files in this pull request and generated 2 comments.
Comments suppressed due to low confidence (2)
platform/deployment_fargate/api_control_plane/utils/get_fleet_config.py:50
- TenantFleetConfig.from_environment() still defaults OPENSRE_TENANT_UID/GID to 10001. Even if callers rely on defaults, that will mismatch the container's uid/gid (1000) and break S3 Files POSIX permissions. Align the defaults with the image user unless the image is also updated.
mypy.ini:71 - This comment says the CDK extra is "not installed in default CI quality", but CI now runs
uv sync ... --extra cdk. Keeping this accurate helps avoid confusion when adding CDK imports and mypy ignores.
Comment on lines
+24
to
+25
| tenant_uid: int = 10001 | ||
| tenant_gid: int = 10001 |
Comment on lines
+32
to
+33
| OPENSRE_TENANT_UID=10001 | ||
| OPENSRE_TENANT_GID=10001 |
|
|
||
|
|
||
| class IamClient(Protocol): | ||
| def create_role(self, **kwargs: Any) -> dict[str, Any]: ... |
| class IamClient(Protocol): | ||
| def create_role(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def get_role(self, **kwargs: Any) -> dict[str, Any]: ... |
|
|
||
| def get_role(self, **kwargs: Any) -> dict[str, Any]: ... | ||
|
|
||
| def put_role_policy(self, **kwargs: Any) -> dict[str, Any]: ... |
Vendor Tracer-Cloud/opensre-infra-aws as platform/deployment_fargate/opensre-infra and add a package script that resolves Terraform memories into fleet CDK params. Co-authored-by: Cursor <cursoragent@cursor.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #
Describe the changes you have made in this PR -
platform/deployment_fargate/(control plane, public API, fleet CDK, gateway lifecycle) andplatform/deployment_ec2/(EC2 boto3 helpers).fargate_fleet_infrastructure/(cluster, outbound SG, log group, execution role) withmake cdk-*targets and synth tests.gateway/control_planeintoapi_control_plane, with public routes inapi_public_forwarder.ecr_deployand GHCR docker-publish workflow; keep EC2 AMI/systemd gateway path.TenantFleetConfigwiring via.env.fargate-fleet.example.Demo/Screenshot for feature changes and bug fixes -
Code Understanding and AI Usage
Did you use AI assistance (ChatGPT, Claude, Copilot, etc.) to write any part of this code?
If you used AI assistance:
Explain your implementation approach:
This PR groups deployment ownership by runtime entity so shared Fargate foundation, per-tenant reconciliation, and EC2 gateway tooling no longer share one ambiguous
platform/deploymentpackage. The CDK stack only creates stable shared fleet resources; per-org ECS services remain in the Python reconciler. EC2 AWS SDK helpers moved toplatform/deployment_ec2because they are not used by the Fargate control plane (which has its ownget_boto3_client).Checklist before requesting a review
Test plan
make cdk-verify(fleet synth tests + app synth)tests/platform/deployment_fargate/cdk deployagainst a sandbox account with explicit VPC/subnet/filesystem/image params (optional)Note: Please check Allow edits from maintainers if you would like us to assist in the PR.
Made with Cursor