tegwick
9751927d38
All checks were successful
Build and Publish Container Image / build-and-push (push) Successful in 38s
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b22-9638-76d2-bbff-b7ea1770b118
63 lines
1.8 KiB
Markdown
63 lines
1.8 KiB
Markdown
---
|
|
id: SBOM-WP-0004
|
|
type: workplan
|
|
title: "Adopt rotated database leases without liveness restarts"
|
|
domain: infotech
|
|
repo: sbom-nexus
|
|
status: active
|
|
owner: codex
|
|
topic_slug: infotech
|
|
created: "2026-08-23"
|
|
updated: "2026-08-23"
|
|
quality_dor: DoR-Ok
|
|
quality_dor_at: "2026-08-23"
|
|
quality_dor_by: codex
|
|
quality_dor_note: "CUST-IN-0014 supplies exact 30-minute expiry/restart evidence, mounted Secret rotation behavior, owner boundaries, value-safety constraints, and live acceptance criteria."
|
|
origin: residual
|
|
origin_ref: CUST-IN-0014
|
|
related:
|
|
- RAPP-SBOM-NEXUS-WP-0003
|
|
---
|
|
|
|
# Adopt rotated database leases without liveness restarts
|
|
|
|
## Reread the mounted DSN on new pool connections
|
|
|
|
```task
|
|
id: SBOM-WP-0004-T01
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Use a value-safe SQLAlchemy connection creator that rereads the mounted URL
|
|
for every new DBAPI connection. Recycle pooled connections before the current
|
|
30-minute lease expires and preserve `pool_pre_ping` so revoked sessions are
|
|
replaced with the current mounted credential.
|
|
|
|
Completed with tests proving two connection attempts observe two file values
|
|
and that the engine URL contains neither username nor password.
|
|
|
|
## Separate liveness from database readiness
|
|
|
|
```task
|
|
id: SBOM-WP-0004-T02
|
|
status: done
|
|
priority: high
|
|
```
|
|
|
|
Expose process-only `/state/live` while retaining the database-backed
|
|
`/state/health` readiness contract. The package must move only liveness to the
|
|
new route so a transient credential handoff removes traffic but does not ask
|
|
Kubernetes to restart an otherwise healthy process.
|
|
|
|
## Prove one complete live lease rotation
|
|
|
|
```task
|
|
id: SBOM-WP-0004-T03
|
|
status: wait
|
|
priority: high
|
|
```
|
|
|
|
Promote the shared new image/package digest, observe at least one complete
|
|
database lease rotation, and require continuous process uptime, recovered
|
|
readiness, no liveness-driven restart, and no credential values in logs.
|