From 1aa26b146eb20fe9489f09de8376546bd30f17ed Mon Sep 17 00:00:00 2001
From: Rafael Benevides <rafabene@gmail.com>
Date: Mon, 6 Jul 2026 10:42:36 -0300
Subject: [PATCH] HYPERFLEET-1229 - chore: disable lifecycle enforcer dry-run
 mode

Lifecycle enforcer has been validated in dry-run for 4 days. Switch
default to active enforcement (dry_run=false) and update documentation.
---
 functions/lifecycle-enforcer/README.md   | 10 +++++-----
 terraform/modules/lifecycle/variables.tf |  2 +-
 terraform/shared/README.md               |  4 ++++
 terraform/shared/variables.tf            |  2 +-
 4 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/functions/lifecycle-enforcer/README.md b/functions/lifecycle-enforcer/README.md
index 655f1fe..5af3a9b 100644
--- a/functions/lifecycle-enforcer/README.md
+++ b/functions/lifecycle-enforcer/README.md
@@ -123,23 +123,23 @@ terraform apply
 
 ### Rollout
 
-1. Deploy with `lifecycle_enforcer_dry_run = true` (default) — logs all actions without executing
+1. Run `terraform apply` in `terraform/shared/` — the enforcer is active by default (`lifecycle_enforcer_dry_run = false`)
 2. Check logs in Cloud Logging:
    ```text
    resource.type="cloud_run_revision"
    resource.labels.service_name="lifecycle-enforcer"
    ```
-3. Add TTL labels to existing clusters:
+3. Add TTL labels to existing clusters that don't have one yet:
    ```bash
    DRY_RUN=false make add-ttl-labels
    ```
-4. When confident, set `lifecycle_enforcer_dry_run = false` in `terraform/shared/` and re-apply
+4. To temporarily disable enforcement without destroying infrastructure, set `lifecycle_enforcer_dry_run = true` and re-apply
 
 ### Configuration (shared module variables)
 
 | Variable                      | Default     | Description                                   |
 | ----------------------------- | ----------- | --------------------------------------------- |
-| `lifecycle_enforcer_dry_run`  | `true`      | Log actions without executing                 |
+| `lifecycle_enforcer_dry_run`  | `false`     | Set to `true` to log actions without executing |
 | `lifecycle_enforcer_schedule` | `0 * * * *` | Cloud Scheduler cron expression (hourly)      |
 
 ### Environment variables (Cloud Function)
@@ -147,7 +147,7 @@ terraform apply
 | Variable         | Default          | Description                                   |
 | ---------------- | ---------------- | --------------------------------------------- |
 | `PROJECT_ID`     | *(required)*     | GCP project to scan for clusters              |
-| `DRY_RUN`        | `true`           | Set to `false` to execute enforcement actions |
+| `DRY_RUN`        | `false`          | Set to `true` to disable enforcement actions  |
 
 ## Development
 
diff --git a/terraform/modules/lifecycle/variables.tf b/terraform/modules/lifecycle/variables.tf
index 5f0d1c9..f91211a 100644
--- a/terraform/modules/lifecycle/variables.tf
+++ b/terraform/modules/lifecycle/variables.tf
@@ -17,7 +17,7 @@ variable "schedule" {
 variable "dry_run" {
   description = "Enable dry-run mode (logs actions without executing them)"
   type        = bool
-  default     = true
+  default     = false
 }
 
 variable "source_dir" {
diff --git a/terraform/shared/README.md b/terraform/shared/README.md
index 3aaa55a..f6a85ca 100644
--- a/terraform/shared/README.md
+++ b/terraform/shared/README.md
@@ -16,6 +16,8 @@ This Terraform configuration creates the shared networking infrastructure that a
 | Firewall | `hyperfleet-dev-vpc-allow-iap-ssh` | Allow SSH via Identity-Aware Proxy |
 | Cloud Router | `hyperfleet-dev-vpc-router` | Required for Cloud NAT |
 | Cloud NAT | `hyperfleet-dev-vpc-nat` | Internet access for private nodes |
+| Cloud Function | `lifecycle-enforcer` | Hourly cluster lifecycle enforcement |
+| Cloud Scheduler | `lifecycle-enforcer-trigger` | Triggers lifecycle enforcer every hour |
 
 ## Prerequisites
 
@@ -118,6 +120,8 @@ The defaults should work for most cases, but you can customize via variables:
 | `subnet_cidr` | Subnet CIDR | `10.100.0.0/16` |
 | `pods_cidr` | Pods secondary range | `10.101.0.0/16` |
 | `services_cidr` | Services secondary range | `10.102.0.0/16` |
+| `lifecycle_enforcer_dry_run` | Log actions without executing | `false` |
+| `lifecycle_enforcer_schedule` | Cron schedule for enforcement | `0 * * * *` |
 
 ## Troubleshooting
 
diff --git a/terraform/shared/variables.tf b/terraform/shared/variables.tf
index a6a4d6a..3833dde 100644
--- a/terraform/shared/variables.tf
+++ b/terraform/shared/variables.tf
@@ -40,7 +40,7 @@ variable "services_cidr" {
 variable "lifecycle_enforcer_dry_run" {
   description = "Run lifecycle enforcer in dry-run mode (logs actions without executing)"
   type        = bool
-  default     = true
+  default     = false
 }
 
 variable "lifecycle_enforcer_schedule" {