fix(cli): validate shared gateway API and NATS hosts

[mikeyrcamp]

TL;DR

Require API and NATS Host overrides when a self-managed control-plane profile routes those services through one shared gateway hostname.

Additional Details

The CLI already validates SIS and ReVal Host overrides for shared gateways. The API gateway URL and compute-reachable NATS URL could still omit their consumed Host overrides, allowing profile validation and registration dry runs to accept routes that the gateway cannot select.

This change validates those two remaining paths, passes the NATS Host through registration reachability checks, and preserves direct service-DNS endpoints that do not need Host overrides.

SIS/ReVal Host forwarding and HTTP probe response handling are provided by #1439. This PR does not duplicate those changes.

Before and After

flowchart LR
  subgraph OLD["Before this PR"]
    direction TB
    B1["API and NATS use a shared gateway hostname"] --> B2["API or NATS Host override is missing"]
    B2 --> B3["Profile validation can pass"]
    B3 --> B4["Registration proceeds to identity discovery and reachability"]
  end

  subgraph NEW["After this PR"]
    direction TB
    A1["Validate control-plane profile"] --> A2{"hosts.api is set"}
    A2 -->|No| A7["Reject before identity discovery or reachability"]
    A2 -->|Yes| A3{"NATS endpoint shares the gateway hostname"}
    A3 -->|Yes| A4{"hosts.nats is set"}
    A4 -->|No| A7
    A3 -->|No, direct service DNS| A5["Profile is valid"]
    A4 -->|Yes| A5
    A5 --> A6["Registration passes NATSHost to reachability validation"]
  end

Loading

For the Reviewer

Please focus on the shared-hostname comparison in the profile and reachability validators and the direct service-DNS compatibility tests.

Public Verification

Run from src/clis/nvcf-cli:

go test ./cmd -run 'Test(ControlPlaneProfileValidateCommandRejectsMissingSharedGatewayHosts|ControlPlaneProfileValidateCommandAcceptsSharedGatewayAPIAndNATSHosts|ComputePlaneRegisterDryRunRejectsMissingSharedGatewayHostsBeforeIdentity|ComputePlaneRegisterDryRunRunsReachabilityCheck)$' -count=1
go test ./internal/selfhosted/controlplaneprofile -run 'TestValidate(SharedGatewayHostnameRequiresAPIAndNATSHostHeaders|SharedGatewayHostnameAcceptsAPIAndNATSHostHeaders|DirectServiceHostnamesDoNotRequireHostOverrides)$' -count=1
go test ./internal/selfhosted/reachability -run 'TestCheck(RequiresHostHeadersForSharedGatewayHostname|AllowsSharedGatewayNATSWithHostOverride|AllowsDirectServiceHostnamesWithoutHostOverrides)$' -count=1
go test ./cmd ./internal/selfhosted/controlplaneprofile ./internal/selfhosted/reachability -count=1
go build ./...

These cases verify that:

• Profiles missing required API or NATS Host overrides for a shared gateway are rejected before identity discovery or reachability.
• Shared-gateway profiles with both overrides are accepted.
• Direct service-DNS endpoints remain accepted without Host overrides.
• Registration passes controlPlane.hosts.nats to reachability validation as NATSHost.

For QA

Additional validation completed:

• Compute-plane Helmfile render and handoff tests
• Live shared-gateway validation with missing and present Host overrides
• git diff --check

Issues

Closes #1484

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Bug Fixes

  • Require API and NATS Host overrides when those endpoints use a shared gateway address.
  • Pass the configured NATS Host into compute-plane reachability validation.
  • Preserve direct service-DNS endpoints that do not require Host overrides.

• Tests

  • Expanded coverage for NATS reachability, endpoint validation, and shared gateway configurations.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: d8d54d36-1b81-47ef-b7d9-ea794afc0c97

📥 Commits

Reviewing files that changed from the base of the PR and between 7e1968a and 074e168.

📒 Files selected for processing (7)

• src/clis/nvcf-cli/cmd/self_hosted_compute_plane.go
• src/clis/nvcf-cli/cmd/self_hosted_compute_plane_test.go
• src/clis/nvcf-cli/cmd/self_hosted_control_plane_test.go
• src/clis/nvcf-cli/internal/selfhosted/controlplaneprofile/profile.go
• src/clis/nvcf-cli/internal/selfhosted/controlplaneprofile/profile_test.go
• src/clis/nvcf-cli/internal/selfhosted/reachability/reachability.go
• src/clis/nvcf-cli/internal/selfhosted/reachability/reachability_test.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The CLI now validates API and NATS Host overrides when service endpoints use a shared gateway hostname. Compute-plane registration passes the configured NATS host into reachability validation.

Changes

Shared Gateway Validation

Layer / File(s)	Summary
Profile host validation src/clis/nvcf-cli/internal/selfhosted/controlplaneprofile/profile.go, src/clis/nvcf-cli/internal/selfhosted/controlplaneprofile/profile_test.go, src/clis/nvcf-cli/cmd/self_hosted_control_plane_test.go	Profile validation recognizes shared gateway API and NATS endpoints and requires the corresponding host overrides. Direct service hostnames remain valid without overrides.
NATS reachability validation src/clis/nvcf-cli/internal/selfhosted/reachability/reachability.go, src/clis/nvcf-cli/internal/selfhosted/reachability/reachability_test.go	Reachability checks accept NATSHost and require it when the NATS endpoint uses the gateway hostname. Tests cover missing and explicit NATS host overrides.
Compute-plane registration integration src/clis/nvcf-cli/cmd/self_hosted_compute_plane.go, src/clis/nvcf-cli/cmd/self_hosted_compute_plane_test.go	Compute-plane registration passes the control plane NATS host to reachability checks. Tests verify the NATS endpoint and derived host.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 074e1

This localized change adds validation for shared API and NATS gateway host overrides while preserving direct service-DNS behavior. No actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 17 functions across 7 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy issue #1484. They require API and NATS Host overrides for shared gateway hostnames, preserve direct service-DNS behavior, pass NATS Host into reachability validation, and test clea…
Out of Scope Changes check	✅ Passed	All implementation and test changes directly support issue #1484 and the stated pull request objectives. No unrelated changes are shown.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits format with the required scoped fix type and accurately describes the shared gateway API and NATS host validation change.

Full details: Linked Issues check

Explanation

The changes satisfy issue #1484. They require API and NATS Host overrides for shared gateway hostnames, preserve direct service-DNS behavior, pass NATS Host into reachability validation, and test clear validation errors.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/control-plane-host-validation

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

🎉 This PR is included in version nvcf-cli-v1.16.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀