tegwick
503bebcb0b
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
84 lines
3.1 KiB
Markdown
84 lines
3.1 KiB
Markdown
---
|
|
id: SBOM-WP-0004
|
|
type: workplan
|
|
title: "Adopt rotated database leases without liveness restarts"
|
|
domain: infotech
|
|
repo: sbom-nexus
|
|
status: finished
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
quality_dor: DoR-Ok
|
|
quality_dor_at: "2026-08-23"
|
|
quality_dor_by: codex
|
|
quality_dor_note: "CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria."
|
|
origin: residual
|
|
origin_ref: CUST-IN-0014
|
|
related:
|
|
- RAPP-SBOM-NEXUS-WP-0003
|
|
state_hub_workstream_id: "5723e707-75ce-5a41-b734-e6aa5d00757e"
|
|
---
|
|
|
|
# Adopt rotated database leases without liveness restarts
|
|
|
|
## Reread the mounted DSN on new pool connections
|
|
|
|
```task
|
|
id: SBOM-WP-0004-T01
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "5bec586f-7eea-5783-a7c1-c8759474c5e0"
|
|
```
|
|
|
|
Use a value-safe SQLAlchemy connection creator that rereads the mounted URL
|
|
for every new DBAPI connection. Recycle pooled connections before the current
|
|
30-minute lease expires and preserve `pool_pre_ping` so revoked sessions are
|
|
replaced with the current mounted credential.
|
|
|
|
Completed with tests proving two connection attempts observe two file values
|
|
and that the engine URL contains neither username nor password.
|
|
|
|
The first live promotion also exposed an Alembic `SET ROLE` autobegin defect:
|
|
the migration logged success but its outer transaction rolled back on close.
|
|
The migration role helper now commits only the role-assumption transaction
|
|
before Alembic starts its own, with an ordering regression test.
|
|
|
|
## Separate liveness from database readiness
|
|
|
|
```task
|
|
id: SBOM-WP-0004-T02
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "e25972bd-8636-5654-91f1-fad49c5f5d2f"
|
|
```
|
|
|
|
Expose process-only `/state/live` while retaining the database-backed
|
|
`/state/health` readiness contract. The package must move only liveness to the
|
|
new route so a transient credential handoff removes traffic but does not ask
|
|
Kubernetes to restart an otherwise healthy process.
|
|
|
|
## Prove one complete live lease rotation
|
|
|
|
```task
|
|
id: SBOM-WP-0004-T03
|
|
status: done
|
|
priority: high
|
|
state_hub_task_id: "a1e88b28-119d-5d1c-a97b-2dd1b3cb9113"
|
|
```
|
|
|
|
Promote the shared new image/package digest, observe at least one complete
|
|
database lease rotation, and require continuous process uptime, recovered
|
|
readiness, no liveness-driven restart, and no credential values in logs.
|
|
|
|
The corrected digest is live at migration `0002 (head)` with process and
|
|
database health passing, repository reads working, and zero pod restarts. The
|
|
first promotion safely proved digest rollback and exposed the now-fixed
|
|
migration transaction guard. Keep this task open through one full lease window.
|
|
|
|
Completed at 2026-08-22T23:06:19Z after 30m51s continuous uptime on pod UID
|
|
`73965817-c653-4017-8b90-e19b70c06b21`. The mounted ExternalSecret had
|
|
refreshed again at 23:02:59Z; the pod remained Ready with restart count zero,
|
|
`/state/live`, database-backed `/state/health`, and repository reads all passed,
|
|
and application logs contained zero credential-pattern matches and zero health
|
|
500 responses. This exceeds the prior exact 30-minute failure point.
|