HYPERFLEET-1229 - chore: disable lifecycle enforcer dry-run mode

functions/lifecycle-enforcer/README.md

@@ -123,31 +123,31 @@ terraform apply
 
 ### Rollout
 
-1. Deploy with `lifecycle_enforcer_dry_run = true` (default) — logs all actions without executing
+1. Run `terraform apply` in `terraform/shared/` — the enforcer is active by default (`lifecycle_enforcer_dry_run = false`)
 2. Check logs in Cloud Logging:
    ```text
    resource.type="cloud_run_revision"
    resource.labels.service_name="lifecycle-enforcer"
    ```
-3. Add TTL labels to existing clusters:
+3. Add TTL labels to existing clusters that don't have one yet:
    ```bash
    DRY_RUN=false make add-ttl-labels
    ```
-4. When confident, set `lifecycle_enforcer_dry_run = false` in `terraform/shared/` and re-apply
+4. To temporarily disable enforcement without destroying infrastructure, set `lifecycle_enforcer_dry_run = true` and re-apply
 
 ### Configuration (shared module variables)
 
 | Variable                      | Default     | Description                                   |
 | ----------------------------- | ----------- | --------------------------------------------- |
-| `lifecycle_enforcer_dry_run`  | `true`      | Log actions without executing                 |
+| `lifecycle_enforcer_dry_run`  | `false`     | Set to `true` to log actions without executing |
 | `lifecycle_enforcer_schedule` | `0 * * * *` | Cloud Scheduler cron expression (hourly)      |
 
 ### Environment variables (Cloud Function)
 
 | Variable         | Default          | Description                                   |
 | ---------------- | ---------------- | --------------------------------------------- |
 | `PROJECT_ID`     | *(required)*     | GCP project to scan for clusters              |
-| `DRY_RUN`        | `true`           | Set to `false` to execute enforcement actions |
+| `DRY_RUN`        | `false`          | Set to `true` to disable enforcement actions  |
 
 ## Development
 

terraform/modules/lifecycle/variables.tf

@@ -17,7 +17,7 @@ variable "schedule" {
 variable "dry_run" {
   description = "Enable dry-run mode (logs actions without executing them)"
   type        = bool
-  default     = true
+  default     = false
 }
 
 variable "source_dir" {

terraform/shared/README.md

@@ -16,6 +16,8 @@ This Terraform configuration creates the shared networking infrastructure that a
 | Firewall | `hyperfleet-dev-vpc-allow-iap-ssh` | Allow SSH via Identity-Aware Proxy |
 | Cloud Router | `hyperfleet-dev-vpc-router` | Required for Cloud NAT |
 | Cloud NAT | `hyperfleet-dev-vpc-nat` | Internet access for private nodes |
+| Cloud Function | `lifecycle-enforcer` | Hourly cluster lifecycle enforcement |
+| Cloud Scheduler | `lifecycle-enforcer-trigger` | Triggers lifecycle enforcer every hour |
 
 ## Prerequisites
 
@@ -118,6 +120,8 @@ The defaults should work for most cases, but you can customize via variables:
 | `subnet_cidr` | Subnet CIDR | `10.100.0.0/16` |
 | `pods_cidr` | Pods secondary range | `10.101.0.0/16` |
 | `services_cidr` | Services secondary range | `10.102.0.0/16` |
+| `lifecycle_enforcer_dry_run` | Log actions without executing | `false` |
+| `lifecycle_enforcer_schedule` | Cron schedule for enforcement | `0 * * * *` |
 
 ## Troubleshooting
 

terraform/shared/variables.tf

@@ -40,7 +40,7 @@ variable "services_cidr" {
 variable "lifecycle_enforcer_dry_run" {
   description = "Run lifecycle enforcer in dry-run mode (logs actions without executing)"
   type        = bool
-  default     = true
+  default     = false
 }
 
 variable "lifecycle_enforcer_schedule" {