GCP-388: No direct cross-cluster network connectivity

[patjlm]

Summary

• Adds design decision document formalizing the rule that no cluster may establish direct TCP/UDP connections to another cluster's kube API by default
• Covers component constraints (Terraform, ArgoCD, CLS/CLM controllers) and SRE operational access patterns (no direct kubectl, break-glass only via escalation)
• Extends existing decisions (rc-mc-transport-layer.md, regional-independence-architecture.md) into a system-wide principle

Test plan

• Review doc structure against design-decisions/TEMPLATE.md checklist
• Verify consistency with rc-mc-transport-layer.md and regional-independence-architecture.md
• Confirm naming convention matches existing decision docs

🤖 Generated with Claude Code

[openshift-ci-robot]

@patjlm: This pull request references GCP-388 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

• Adds design decision document formalizing the rule that no cluster may establish direct TCP/UDP connections to another cluster's kube API by default
• Covers component constraints (Terraform, ArgoCD, CLS/CLM controllers) and SRE operational access patterns (no direct kubectl, break-glass only via escalation)
• Extends existing decisions (rc-mc-transport-layer.md, regional-independence-architecture.md) into a system-wide principle

Test plan

• Review doc structure against design-decisions/TEMPLATE.md checklist
• Verify consistency with rc-mc-transport-layer.md and regional-independence-architecture.md
• Confirm naming convention matches existing decision docs

🤖 Generated with Claude Code

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Walkthrough

A new design decision document was added establishing a no-direct-cross-cluster-connectivity policy for GCP-HCP infrastructure. The policy forbids direct TCP/UDP cross-cluster connections by default across Global, Regional, and Management clusters, with exceptions only via controlled escalation, mandating indirect coordination mechanisms instead.

Changes

Cohort / File(s)

Summary

Design Decision Documentation design-decisions/no-direct-cross-cluster-connectivity.md

New design decision document establishing architectural policy for cluster connectivity. Defines scope covering Global, Regional, and Management clusters; documents alternatives evaluated (default no direct, controlled direct, VPN mesh); provides rationale grounded in defense-in-depth and zero-trust principles; outlines consequences, cross-cutting concerns, and implementation impact for Terraform, ArgoCD, cross-cluster controllers, and SRE operations. Explicitly excludes worker-node PSC data-plane connectivity from scope.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and specifically describes the main change: addition of a design decision document establishing a no-direct-cross-cluster-connectivity policy.
Description check	✅ Passed	The description is directly related to the changeset, explaining what the design decision document covers, its scope, and the test plan for review.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

No actionable comments were generated in the recent review. 🎉

Warning

Review ran into problems

🔥 Problems

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[jimdaga]

/lgtm