fix(operator): use Cloud Map SRV + service-ARN integration (fixes live 503/BadRequest)

Live E2E against a real account revealed the documented Option-1 wiring
does not work: an HTTP API VPC_LINK integration rejects a raw
'http://<dns>:<port>' URI with

  BadRequestException: For VpcLink VPC_LINK, integration uri should be a
  valid ELB listener ARN or a valid Cloud Map service ARN.

Correct wiring (matches CDK's HttpServiceDiscoveryIntegration):
- Cloud Map service uses an SRV record (not A) so the container port is
  captured; ECS registers the task IP + port into it.
- ECS service registry sets containerName/containerPort and the task def
  exposes the container port, so ECS writes the SRV record.
- API Gateway integration URI is the Cloud Map *service ARN* with
  connectionType=VPC_LINK and integrationMethod=ANY; the port is resolved
  from SRV.

Verified end-to-end (POST through API Gateway → VPC Link → Cloud Map SRV
→ Fargate task returned HTTP 200 with the request echoed at
/prod/webhook/telegram), then torn down cleanly.

build + clippy -D warnings + cargo test (11 passed).

Author: chaodu-agent

operator/README.md

@@ -241,7 +241,7 @@ spec:
 
 On `apply` this reconciles (idempotently, reused by name):
 
-1. **Cloud Map** private DNS namespace + a per-service A record
+1. **Cloud Map** private DNS namespace + a per-service **SRV** record (carries the container port; a plain A record does not work as a VPC-Link integration target)
 2. **ECS service registry** wiring (attached at service creation)
 3. **VPC Link** (shared `oab-vpc-link`), waits until `AVAILABLE`
 4. **API Gateway HTTP API** (`oab-webhook-<ns>-<name>`, one per bot) + `HTTP_PROXY` integration over the VPC Link

operator/src/apply.rs

@@ -182,13 +182,25 @@ async fn apply_ecs(
         .collect();
 
     // 4. Register task definition
-    let container = ContainerDefinition::builder()
+    let mut container = ContainerDefinition::builder()
         .name("openab")
         .image(&m.spec.image)
         .essential(true)
         .set_environment(Some(env_vars))
-        .set_secrets(if secrets.is_empty() { None } else { Some(secrets) })
-        .build();
+        .set_secrets(if secrets.is_empty() { None } else { Some(secrets) });
+
+    // Ingress needs the container port exposed so ECS can register an SRV record
+    // (Cloud Map + API Gateway learn the target port from it).
+    if let Some(ingress) = &m.spec.ingress {
+        container = container.port_mappings(
+            aws_sdk_ecs::types::PortMapping::builder()
+                .container_port(ingress.container_port as i32)
+                .protocol(aws_sdk_ecs::types::TransportProtocol::Tcp)
+                .build(),
+        );
+    }
+
+    let container = container.build();
 
     let task_def = ecs
         .register_task_definition()
@@ -294,11 +306,16 @@ async fn apply_ecs(
             .network_configuration(network_config);
 
         if let Some(cm) = &cloud_map {
-            create_req = create_req.service_registries(
-                aws_sdk_ecs::types::ServiceRegistry::builder()
-                    .registry_arn(&cm.registry_arn)
-                    .build(),
-            );
+            let mut registry = aws_sdk_ecs::types::ServiceRegistry::builder()
+                .registry_arn(&cm.registry_arn);
+            // SRV records require the container name + port so ECS registers the
+            // task's port alongside its IP.
+            if let Some(ingress) = &m.spec.ingress {
+                registry = registry
+                    .container_name("openab")
+                    .container_port(ingress.container_port as i32);
+            }
+            create_req = create_req.service_registries(registry.build());
         }
 
         create_req
@@ -329,7 +346,7 @@ async fn apply_ecs(
             ingress,
             &ecs_rt.networking.subnets,
             &ecs_rt.networking.security_groups,
-            &cm.dns_name,
+            &cm.registry_arn,
         )
         .await?;
         println!("  🔗 Webhook URL(s) for {}:", m.metadata.name);

operator/src/ingress.rs

@@ -29,10 +29,9 @@ fn api_name(namespace: &str, name: &str) -> String {
 
 /// Result of Cloud Map reconciliation, consumed when creating the ECS service.
 pub struct CloudMapResult {
-    /// Cloud Map service ARN — used as the ECS service registry ARN.
+    /// Cloud Map service ARN — used both as the ECS service registry ARN and as
+    /// the API Gateway integration URI.
     pub registry_arn: String,
-    /// Private DNS name the task registers under, e.g. `oab-prod-mybot.oab`.
-    pub dns_name: String,
 }
 
 /// Step 1: ensure the Cloud Map private DNS namespace and service exist.
@@ -63,10 +62,7 @@ pub async fn ensure_cloud_map(
         eprintln!("  ✓ Created Cloud Map service: {dns_name}");
     }
 
-    Ok(CloudMapResult {
-        registry_arn,
-        dns_name,
-    })
+    Ok(CloudMapResult { registry_arn })
 }
 
 /// Step 2: ensure VPC Link, HTTP API, integration, routes, stage, and the
@@ -78,7 +74,7 @@ pub async fn ensure_gateway(
     ingress: &Ingress,
     subnets: &[String],
     security_groups: &[String],
-    dns_name: &str,
+    cloud_map_service_arn: &str,
 ) -> Result<Vec<String>> {
     let api = aws_sdk_apigatewayv2::Client::new(config);
     let ec2 = aws_sdk_ec2::Client::new(config);
@@ -93,9 +89,10 @@ pub async fn ensure_gateway(
     // ── HTTP API (one per bot — avoids cross-bot path collisions) ──────────
     let (api_id, api_endpoint) = ensure_api(&api, &api_name).await?;
 
-    // ── Integration: VPC Link → Cloud Map DNS name on the container port ────
-    let integration_uri = integration_uri(dns_name, ingress.container_port);
-    let integration_id = ensure_integration(&api, &api_id, &vpc_link_id, &integration_uri).await?;
+    // ── Integration: VPC Link → Cloud Map service (URI is the service ARN;
+    //    the port is resolved from the service's SRV record) ───────────────
+    let integration_id =
+        ensure_integration(&api, &api_id, &vpc_link_id, cloud_map_service_arn).await?;
 
     // ── One route per webhook path, all → the same integration ─────────────
     for path in &ingress.paths {
@@ -108,11 +105,6 @@ pub async fn ensure_gateway(
     Ok(webhook_urls(&api_endpoint, &ingress.paths))
 }
 
-/// Integration URI for the VPC Link → Cloud Map target on the container port.
-fn integration_uri(dns_name: &str, port: u16) -> String {
-    format!("http://{dns_name}:{port}")
-}
-
 /// API Gateway route key for a webhook path (POST only).
 fn route_key(path: &str) -> String {
     format!("POST {path}")
@@ -258,9 +250,12 @@ async fn ensure_service(
         }
     }
 
-    // Create with a single A record (TTL 60). SRV does NOT work for VPC Link.
+    // Create with an SRV record. For an HTTP API private integration whose URI
+    // is the Cloud Map service ARN, API Gateway learns the target port from the
+    // SRV record — a plain A record carries no port and does NOT work. ECS
+    // registers the task's IP + container port into this SRV record.
     let dns_record = DnsRecord::builder()
-        .r#type(RecordType::A)
+        .r#type(RecordType::Srv)
         .ttl(60)
         .build()
         .context("failed to build DNS record")?;
@@ -532,7 +527,7 @@ async fn ensure_integration(
         .create_integration()
         .api_id(api_id)
         .integration_type(IntegrationType::HttpProxy)
-        .integration_method("POST")
+        .integration_method("ANY")
         .integration_uri(integration_uri)
         .connection_type(ConnectionType::VpcLink)
         .connection_id(vpc_link_id)
@@ -617,18 +612,6 @@ async fn ensure_stage(api: &aws_sdk_apigatewayv2::Client, api_id: &str) -> Resul
 mod tests {
     use super::*;
 
-    #[test]
-    fn integration_uri_uses_dns_and_port() {
-        assert_eq!(
-            integration_uri("oab-prod-mybot.oab", 8080),
-            "http://oab-prod-mybot.oab:8080"
-        );
-        assert_eq!(
-            integration_uri("svc.ns", 3000),
-            "http://svc.ns:3000"
-        );
-    }
-
     #[test]
     fn route_key_is_post_prefixed() {
         assert_eq!(route_key("/webhook/telegram"), "POST /webhook/telegram");