[roeezolantz]

Lets teecryptor reach the GKE ct-server over Private Service Connect, so ct-server's public ingress can be removed. VPC peering is not an option: both VPCs use 10.0.0.0/x.

What changed

• Setting ct_server_service_attachment (URL, default empty = off) creates only the consumer side: subnet, internal IP, PSC endpoint
• The producer attachment, NAT subnet and allow list live with the cluster (cofhe generator), not here
• Endpoint region comes from the URL; PSC global access is on when it differs from region (testnet)
• CT_SOURCE_URL is derived from the endpoint; a precondition requires exactly one of ct_source_url / the attachment URL

Test

terraform validate + fmt; URL check and region derivation evaluated offline. Merge order: FhenixProtocol/k8s_cluster_gitops#4 (NAT subnet) → FhenixProtocol/cofhe#1097 → #11 → FhenixProtocol/gitops#60 → FhenixProtocol/cofhe#1098; each applied testnet first.

Summary by CodeRabbit

• New Features
  • Added optional Private Service Connect connectivity for private ct-server access.
  • Automatically provisions the required regional endpoint and uses its URL when configured.
  • Retains direct URL connectivity when Private Service Connect is not enabled.
• Documentation
  • Added example configuration and guidance for connecting through a service attachment.
  • Documented the /GetStoredCt endpoint and configurable consumer subnet range.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 0ef0526e-6727-4c07-a001-f7d0bc3f3a58

📥 Commits

Reviewing files that changed from the base of the PR and between 6dd84e7 and 0d94efe.

📒 Files selected for processing: 3

• compute/main.tf
• compute/terraform.tfvars.example
• compute/variables.tf

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Terraform can now configure ct-server access through either a direct URL or a Private Service Connect service attachment. The configuration adds PSC endpoint resources, passes the selected URL to the VM, and documents the new inputs.

Changes: ct-server connectivity

Layer / File(s)	Summary
Connectivity inputs compute/variables.tf, compute/terraform.tfvars.example	Adds inputs for the service attachment and PSC consumer subnet. Updates the direct URL documentation and adds an example attachment configuration.
PSC endpoint and VM wiring compute/main.tf	Creates PSC networking resources when a service attachment is configured. Selects the direct or PSC endpoint URL for the VM, requires exactly one connection option, and makes VM creation depend on the forwarding rule.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Feature

Suggested reviewers: liorbond

Merge Risk: ⚪ Minimal · up to 0d94e

This change adds an optional private connection path from teecryptor to the ct-server that is off by default. Existing deployments that use a direct URL are unaffected. The suspected region-parsing bug was checked and is not real, and no merge-blocking issues remain.

Security architecture risk: 🟡 Moderate · up to 0d94e

The private connection can reduce public exposure, but changing the connection path does not update running VMs automatically. Rollback can remove an endpoint that existing VMs still use, requiring coordination between fleet replacement and endpoint retirement.

Retained concerns

• Medium · reliability · inferred: PSC endpoint lifetime follows the desired Terraform selector, but running VMs retain their previous CT_SOURCE_URL until explicitly replaced. Disabling PSC can therefore remove an endpoint still used by the fleet. Enabling PSC likewise does not establish that running VMs have stopped using public ingress. The manual-update policy predates this PR; the new concern is its interaction with endpoint creation and retirement during a security-relevant network cutover.

Security review details

Security Blast Radius

• inferred — The demonstrated transition risk affects ct-server connectivity for instances in the compute MIG and the timing of retiring their previous connection path. The inspected changes do not establish expanded secret authority or exposure across additional tenants or data stores. Producer-side exposure cannot be determined from these consumer resources.

Trust Boundaries and Controls

• observed — The new trust transition is from the consumer VPC through an operator-selected PSC attachment to the cluster-owned service. Local controls validate attachment syntax, require exclusive source selection and order template creation after the forwarding rule. No producer acceptance or application-readiness condition is encoded in these blocks.

Resilience and Maintainability Implications

• inferred — Desired Terraform state and live VM connection state can diverge during cutover, repetition or recovery. An interrupted migration can leave mixed-source instances; removing either connection path without checking fleet adoption can strand dependent instances. The configured replacement controls do not independently close this lifecycle gap.

Hardening Proposals

• proposed — Separate endpoint retention from source selection so rollback can publish the direct-source template, replace and verify all instances, and only then retire PSC. Apply the same adoption gate before removing public ingress during forward migration.
• proposed — Make producer acceptance and a successful ct-server read through the intended endpoint explicit cutover checks, rather than treating forwarding-rule creation as proof of end-to-end readiness.

Pre-merge checks: 5

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: adding an optional Private Service Connect path to the GKE ct-server.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}