dohertj2/ScadaBridge
1
0
Fork 0
Code Issues 2 Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore(docker-env2): live-gate the second env on the gRPC PSK build #31

New Issue
Closed
opened 2026-07-23 11:52:31 -04:00 by dohertj2 · 1 comment
dohertj2 commented 2026-07-23 11:52:31 -04:00
Owner
Copy Link
Copy Source

Severity: Low (secondary test topology) · Area: Docker / test infra

What

The docker-env2/ topology has its GrpcPsk in config but was never redeployed or live-gated against the ClusterClient→gRPC migration build.

Action

When docker-env2 is next rebuilt from a post-Phase-0 main, run the same checks the docker/ rig gate used:

  • both site nodes boot with the key (StartupValidator passes)
  • unauthenticated control-plane call ⇒ PermissionDenied; correct key ⇒ success
  • LocalDb sync unaffected

Reference gate format: docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md.

**Severity:** Low (secondary test topology) · **Area:** Docker / test infra ## What The `docker-env2/` topology has its `GrpcPsk` in config but was **never redeployed or live-gated** against the ClusterClient→gRPC migration build. ## Action When `docker-env2` is next rebuilt from a post-Phase-0 `main`, run the same checks the `docker/` rig gate used: - both site nodes boot with the key (StartupValidator passes) - unauthenticated control-plane call ⇒ `PermissionDenied`; correct key ⇒ success - LocalDb sync unaffected Reference gate format: `docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md`.
dohertj2 commented 2026-07-23 14:10:33 -04:00
Author
Owner
Copy Link
Copy Source

Gated 2026-07-23 — PASS 3/3. Rebuilt scadabridge:latest from main @ 8524a7f7 and recreated only the env2 containers (primary rig untouched). site-x PSK dev-grpc-psk-docker-env2-site-x matches central's SitePsks__site-x.

  1. Both site nodes boot with the key — StartupValidator is fail-closed on a missing GrpcPsk, so both reaching 'Application started' + gRPC listener on :8083 proves the key is present.
  2. Control-plane PSK auth (grpcurl → SiteStreamService/PullAuditEvents on :9123 and :9124): no-header ⇒ PermissionDenied, wrong key ⇒ PermissionDenied, correct key ⇒ success ({}) — on both nodes.
  3. LocalDb unaffected — env2 is local-only (no replication peer); 0 LocalDb errors, both nodes boot healthy, clean reconcile passes.

Bonus: central logs 'Site site-x registered online via heartbeat' (site→central gRPC live); no real ClusterClient/receptionist (only the benign ClusterClientSiteAuditClient label, identical to the primary rig).

Note: ScadaBridgeConfig2.dbo.Sites is empty, so central treats site-x as 'unknown/not configured' — a first-time-setup seeding gap (seed-sites.sh not run on the fresh DB), orthogonal to the transport. Full record: docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md (commit e0f105c3).

Gated 2026-07-23 — PASS 3/3. Rebuilt scadabridge:latest from main @ 8524a7f7 and recreated only the env2 containers (primary rig untouched). site-x PSK dev-grpc-psk-docker-env2-site-x matches central's SitePsks__site-x. 1. Both site nodes boot with the key — StartupValidator is fail-closed on a missing GrpcPsk, so both reaching 'Application started' + gRPC listener on :8083 proves the key is present. 2. Control-plane PSK auth (grpcurl → SiteStreamService/PullAuditEvents on :9123 and :9124): no-header ⇒ PermissionDenied, wrong key ⇒ PermissionDenied, correct key ⇒ success ({}) — on both nodes. 3. LocalDb unaffected — env2 is local-only (no replication peer); 0 LocalDb errors, both nodes boot healthy, clean reconcile passes. Bonus: central logs 'Site site-x registered online via heartbeat' (site→central gRPC live); no real ClusterClient/receptionist (only the benign ClusterClientSiteAuditClient label, identical to the primary rig). Note: ScadaBridgeConfig2.dbo.Sites is empty, so central treats site-x as 'unknown/not configured' — a first-time-setup seeding gap (seed-sites.sh not run on the fresh DB), orthogonal to the transport. Full record: docs/plans/2026-07-22-clusterclient-to-grpc-live-gate.md (commit e0f105c3).
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
dohertj2 (dohertj2)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dohertj2/ScadaBridge#31
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?