mirrors/pikasTech-HWLAB
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: preserve secret-url DB readiness authority

Browse Source
This commit is contained in:
Code Queue Review
2026-05-22 23:19:13 +00:00
parent ca1cde56e5
commit 332f50493c
24 changed files with 442 additions and 286 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/dev-runtime-boundary.md
+28 -14
View File
@@ -54,35 +54,49 @@ node scripts/d601-k3s-readonly-observability.mjs
The preflight must not print secret values, kubeconfig material, ConfigMap
values, or token content.
## Cloud API DB DNS Contract
## Cloud API DB Readiness Authority
`hwlab-cloud-api` reads the DEV database connection string from Secret
reference `hwlab-cloud-api-dev-db/database-url`. The Secret value is not stored
in source, not printed by reports, and not required for offline validation.
The non-secret DNS contract is source-controlled:
Runtime DB readiness uses the redacted host parsed from the injected
`HWLAB_CLOUD_DB_URL` Secret value:
| Field | Value |
| --- | --- |
| Authority source | `secret-url-host` |
| Authority env | `HWLAB_CLOUD_DB_URL` |
| Required for readiness | `true` |
| Probe target | redacted host and port parsed from the Secret URL |
Health output may report `endpointSource: secret-url-host`, DNS/TCP result,
`liveConnected`, and `liveDbEvidence`, but must keep the DB endpoint and Secret
value redacted.
The non-secret `cloud-api-db` name is an optional desired alias:
| Field | Value |
| --- | --- |
| Source | `optional-public-dns-alias` |
| Service | `cloud-api-db` |
| Namespace | `hwlab-dev` |
| Host | `cloud-api-db.hwlab-dev.svc.cluster.local` |
| Port | `5432` |
| Port name | `postgres` |
| Required for readiness | `false` |
| Used for probe | `false` |
`deploy/k8s/base/services.yaml` must include a selectorless
`Service/cloud-api-db` with that port so k3s DNS has a stable handle before the
actual DB endpoints are provisioned. A selectorless Service proves only that
the name can exist in cluster DNS; it does not prove a DB endpoint, credential,
TCP connection, schema migration, durable persistence, or M4/M5 readiness.
Missing `Service/cloud-api-db`, Endpoint, EndpointSlice, or alias env vars must
not reverse-fail live DB success from the Secret URL host. A future PR may make
that alias operational only if it also owns the Service plus Endpoint or
EndpointSlice manifests and the rollout/apply contract.
`deploy/deploy.json`, `deploy/k8s/base/workloads.yaml`, and
`internal/cloud/db-contract.mjs` must agree on
`HWLAB_CLOUD_DB_SERVICE_NAME`, `HWLAB_CLOUD_DB_SERVICE_NAMESPACE`,
`HWLAB_CLOUD_DB_HOST`, and `HWLAB_CLOUD_DB_PORT`. `npm run validate` checks
this agreement offline. A live pass still requires `/health/live` to report
`db.ready=true`, `db.connected=true`, and `liveDbEvidence=true` with secret
values redacted.
Source validation checks `HWLAB_CLOUD_DB_URL`, `HWLAB_CLOUD_DB_SSL_MODE`,
`endpointSource=secret-url-host`, and `liveDbEvidence=true` with secret values
redacted. It must not require `HWLAB_CLOUD_DB_SERVICE_NAME`,
`HWLAB_CLOUD_DB_SERVICE_NAMESPACE`, `HWLAB_CLOUD_DB_HOST`, or
`HWLAB_CLOUD_DB_PORT` as current readiness inputs.
The DB readiness contract is layered: