WIP: Add ensure-integration-network job and terraform for GCP integration subnet

[aramprice]

CI Description of Changes:

Introduces a manually-triggered Concourse job, ensure-integration-network, that idempotently creates the per-branch GCP subnetwork consumed by the test-stemcells-ipv4 and bats jobs (deploy-director, cleanup-bats-vms, prepare-bats) under the bosh-concourse VPC.
Why

---

The test-stemcells-ipv4 and bats jobs in ci/pipelines/builder.yml assume a subnetwork named stemcell-builder-integration-<subnet_int> exists in the projects/cloud-foundry-310819/global/networks/bosh-concourse VPC, with a /24 at 10.100.<subnet_int>.0/24, gateway .1, private Google access, and IPV4_ONLY stack type. Until now this subnet had to be created and maintained out of band; this change captures it as code so it can be recreated reproducibly per branch (subnet_int is set per branch in ci/pipelines/vars.yml).
What

---

• ci/tasks/ensure-integration-network/{input,network,output}.tf
  • hashicorp/google ~> 5.0
  • google_compute_subnetwork "integration":
    name = stemcell-builder-integration-<subnet_int>
    ip_cidr_range = 10.100.<subnet_int>.0/24
    region = europe-north2 (matches GCP_ZONE
    europe-north2-a in deploy-director)
    network = bosh-concourse (configurable)
    private_ip_google_access = true
    purpose = PRIVATE
    stack_type = IPV4_ONLY
  • subnet_int is taken as input so the same module produces the
    appropriate subnet for any branch.
• ci/pipelines/builder.yml
  • New infrastructure group containing the new job.
  • New resource_type terraform_type (ljfranklin/terraform-resource).
  • New resource integration-network-environment (GCS backend). The
    bucket is referenced via the Concourse credential
    ((integration_network_terraform_state_bucket)); pick a bucket name
    and add the credential before flying. A TODO comment marks this.
  • New job ensure-integration-network:
    • serial: true, manual trigger only (no trigger: true on get).
    • Puts to integration-network-environment with
      env_name = stemcell-builder-integration-<subnet_int>, so the
      state file is deterministically named and re-discovered on
      subsequent runs (no recreate-on-rerun).
    • Apply only — never destroyed by this job, since the subnet is
      long-lived shared infrastructure.
    • No passed: constraint on the existing test/bats jobs to avoid
      coupling; the job is intended to be run on demand when the
      subnet needs to be created or reconciled.
      Verification

---

• ytt -f ci/pipelines/builder.yml -f ci/pipelines/vars.yml renders
  successfully.
• fly validate-pipeline -c <rendered> reports "looks good".
  Follow-ups

---

• Create the GCS bucket that will hold terraform state and set the
  ((integration_network_terraform_state_bucket)) Concourse credential.
• If the existing subnetwork in cloud-foundry-310819 is to be adopted
  rather than recreated, run terraform import once before flying the
  job (or delete the existing subnet first).

NOTE: this repository uses a "Merge Forward" strategy

Changes should be made in the earliest applicable branch, and
merged forward through subsequent branches.

1. Create a PR into the oldest branch (ubuntu-<short_name>)
2. After this PR has been merged create a merge-to-<next_short_name> branch
3. Merge ubuntu-<short_name> into merge-to-<next_short_name>
4. Create a PR to merge merge-to-<next_short_name> into ubuntu-<next_short_name>
5. Repeat as needed for subsequent branches

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0335c108-e02b-4720-a3c0-e627386716db

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ensure-integration-network

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}