feat: support shared org and space-scoped broker for PR deployments - #1267
Closed
bonzofenix wants to merge 17 commits into
Closed
feat: support shared org and space-scoped broker for PR deployments#1267bonzofenix wants to merge 17 commits into
bonzofenix wants to merge 17 commits into
Conversation
- Add EXISTING_ORGANIZATION support for deploying into shared org - Use space-scoped service broker for PR deployments - Target org/space before broker creation - Add enable-service-access.sh for space-scoped broker visibility - Pass valid_org_guid for metricsgateway XFCC validation - Extend common.sh with deployment helper functions
This was referenced Jun 17, 2026
- Remove duplicate deploy-cleanup Makefile target (already defined later) - cf_deployment_login: remove duplicate cf api call (cf_admin_login sets it on main path; move it to PR branch path only) - Drop trailing return 0 from 7 functions that fall off naturally - Collapse 3-line space_scoped_flag conditional to one line
…ility cf orgs/cf spaces only list resources where the current user has a direct role. OrgManager is org-level, not space-level, so a freshly-created space is invisible to cf spaces for the org-manager user, causing find_or_create_space to attempt cf create-space on an existing space and fail with "not authorized". Switch both find_or_create_org and find_or_create_space to use the CF v3 API (which respects OrgManager visibility) with jq -e for a clean exit-code check, removing the intermediate variable, python3 dependency, and string comparison.
The step's purpose is to create the space and grant roles to org-manager-user. Using cf_deployment_login (which logs in as org-manager-user for PRs) creates a chicken-and-egg problem: org-manager-user has no space role yet, so it cannot see or create the space it needs to be granted roles on. Use cf_admin_login unconditionally — admin always has permission to create spaces and grant roles, regardless of PR vs main branch.
asalan316
reviewed
Jun 25, 2026
asalan316
reviewed
Jun 25, 2026
asalan316
reviewed
Jun 25, 2026
asalan316
reviewed
Jun 25, 2026
asalan316
reviewed
Jun 25, 2026
asalan316
reviewed
Jun 25, 2026
Co-authored-by: Arsalan Khan <asalan316@hotmail.com>
Co-authored-by: Arsalan Khan <asalan316@hotmail.com>
Co-authored-by: Arsalan Khan <asalan316@hotmail.com>
Reverts the rename introduced in this PR. cf_login is the established name used by cleanup-autoscaler-deployments.sh and is clearer in context since all callers already know they are logging in as admin.
These functions were added as preparatory work but never wired into any caller. Removing dead code until there is a concrete use case.
/v3/spaces?names=X matches spaces across all orgs the user can see. Without the org_guid filter, autoscaler-mta-main matched a space in another org, causing find_or_create_space to skip creation and then fail when cf target -s found no space in the current org.
…sible When org-manager-user calls cf_target, the v3 spaces API may return 0 results for a space that already exists — because org-manager-user has OrgManager role but no direct space role yet (SpaceDeveloper is granted separately, after space creation). This caused cf create-space to be called, which fails with "not authorized", aborting the deploy step. Make cf create-space non-fatal in find_or_create_space. The real success gate is cf target -s, which succeeds if the space exists and is visible to the current user (OrgManager can always target spaces in their org).
cf_target calls find_or_create_space, which creates the space if the v3 API returns no results. When cleanup runs as admin before org-manager-user has targeted the space, admin becomes the space creator — org-manager-user never gets a direct space role, so subsequent v3 API visibility checks return 0 and spuriously re-trigger cf create-space. Replace cf_target with a plain cf target that skips gracefully when the space doesn't exist instead of creating it.
Root cause: org-manager-user lost SpaceDeveloper between the deploy step and test execution (~50 min gap). Without it, cf curl POST to create tasks returns an authorization error, failing all acceptance test suites. Previously admin created the space and explicitly granted roles to org-manager-user — but those roles could be lost if anything recreated the space between deploy and test execution. Fix: - Have org-manager-user create the space (creator auto-gets SpaceManager+SpaceDeveloper, which persists with the space) - Admin only needs roles for cleanup operations - Test runner re-ensures SpaceDeveloper as a safety net before task launch - Added diagnostic logging: app state, droplet, and full CF API response on task creation failure (no more silent errors)
asalan316
reviewed
Jun 26, 2026
| 'The necessary changes to the environment get lost when make exits its process.' | ||
| @${MAKEFILE_DIR}/scripts/os-infrastructure-login.sh | ||
|
|
||
| .PHONY: register-broker |
asalan316
approved these changes
Jun 26, 2026
asalan316
left a comment
asalan316
left a comment
Contributor
There was a problem hiding this comment.
Approved with some minor findings
bonzofenix
marked this pull request as draft
June 29, 2026 09:09
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Enables PR deployments to use a shared existing CF org with space-scoped service brokers, instead of creating a new org per deployment.
Changes
scripts/common.sh: Add deployment helper functions (cf_target, space-scoped broker logic)scripts/vars.source.sh: Add EXISTING_ORGANIZATION variable supportscripts/build-extension-file.sh: Pass valid_org_guid for metricsgateway XFCCscripts/mta-deploy.sh: Target org/space before space-scoped broker creationscripts/enable-service-access.sh: New — enable service access for space-scoped brokerscripts/create-org-manager-user.sh: Simplified for shared org workflowscripts/extension-file.tpl.yaml: Add metricsgateway org-guid configTesting
Part 3 of 4 — Split from #1149 for easier review.