feat: adopt R1 MeshDB service identity - #488
Draft
cristibleotiu wants to merge 2 commits into
Draft
Conversation
What changed: - recognize exact R1 MeshDB and legacy image repositories - reject reserved database users before certificate side effects - pin the local verification bed to the signed digest and 500ms bound Why: - allow the final service image without changing persisted CockroachDB contracts
What changed: - validate reserved CockroachDB users immediately after service-kind resolution - cover create and update ordering before payment and node lookup Why: - prevent invalid managed-service requests from reaching downstream side effects
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Deeploy must adopt the published R1 MeshDB service identity while remaining compatible with existing CockroachDB jobs and rejecting reserved database users before any billable or node-selection work.
Changes
Verification
python -m unittest discover -s extensions/business/deeploy/tests -p 'test_*.py': 247 tests passed.5c1adb53cd6e6dd457a950711247b8367962ac05built and deployed in A6 runa6-7256936.500mstestbed passed all 10 gates: secure manager deployment, TLS contract, 10k-row replication, concurrent workloads, member outage/rejoin, sequential and fleet edge restarts, normal edit, and certificate regeneration.Rollout
Land this edge change before, or atomically with, the coordinated dapp branding change. Do not deploy the dapp first.
Database release tested:
ghcr.io/ratio1/r1-meshdb@sha256:3be00a63467628d0f5c3382be8ae7a885c5b658762dfd095fba0cb0b5549fab4.Coordinated dapp PR: Ratio1/deeploy-dapp#143.