chore(infra): `GET /healthz?deep=1` through the database and a `status.woven` probe; SLO measured on it

Ouverte
  • Quelque chose ne va pas ?
#42 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
5/5
Temps estimé
Plus d'une semaine
Accessibilité débutants
35/100
Type d'issue
Fonctionnalité
Clarté
Clairement spécifiée
Activité
Active
Stack technique
postgresql, rust
Domaine
backend, databases, observability

Piste de recherche

Start with crates/thrust-api/src/lib.rs and the Database port in crates/thrust-ports/src/lib.rs; read the existing /healthz handler and the blocker #37 outcome before choosing the probe path. Check the contract test and the Gatus configuration in the infrastructure repository, since both repositories are involved. Done means the deep probe reports database availability, Gatus records it as the SLO source, and the specified ADR, questions, and spec updates are complete.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

area:infra prio:p0 review:fable-2026-10-19

Context

/healthz returns ok without touching the database (crates/thrust-api/src/lib.rs:132-134, mounted at line 271; research/0004:389), and the Database port has no ping method (crates/thrust-ports/src/lib.rs:92-138). status.woven is the Gatus page, configured in shared/aws/status-page/files/gatus.yaml in the infra repository (process: infrastructure/.claude/rules/status-page.md). It does not probe the Thrust database path (research/0010:176). Q-0130.3 was answered in round 18: Gatus probes health and API SLIs (QUESTIONS.md:247). The SLO is 99.5 % availability (SPEC.md:78), which over 30 days allows about 3.6 hours of downtime.

Problem

Product availability now includes:

  • woven-o11y, an observability cluster that was upgraded from 1.32 to 1.37 four days before the Postgres landed, with a primary PodDisruptionBudget of 0 on thrust-pg;
  • the tunnel's cloudflared pods, which both clusters share;
  • a beta Workers VPC (ADR-0094:39; research/0010 §6 risks 1, 2 and 7).

Q-0094.4 (QUESTIONS.md:303) asks whether that is acceptable for the SLO and whether status.woven should probe the path; Q-0094.7 (QUESTIONS.md:339) lists the probe too. Nothing measures the coupling today, so a breach of the budget would go unseen.

Proposal

Answer Q-0094.4 with three conditions (ADR-0094 round-29 note):

  1. Deep probe. GET /healthz?deep=1 on the product hostname runs one statement through the database and returns 200 ok, or 503 with no error detail; plain /healthz stays database-free. Add an untenanted ping to the Database port (under the SystemScope from #35). Use a statement that Hyperdrive never caches, such as SELECT now(): Hyperdrive caches reads that use only IMMUTABLE functions, so select 1 could be answered from its cache on any config with caching enabled (hyperdrive/concepts/query-caching). If #37 picks the Durable Object, the probe goes through the object instead.
  2. Probe and SLO. status.woven probes that URL every 60 s, and the SLO is measured on the probe end to end, so cluster upgrades and tunnel outages count against the budget.
  3. Exit trigger, written into ADR-0094: two breaches of the monthly budget in one quarter, or an EKS upgrade that needs more than the budget, moves the database to ADR-0094 Option 3 (managed Postgres) or to the #37 outcome.

The probed path must stay outside any Access gate. The prober is a non_identity WARP session, and gating a probed host breaks it (ADR-0141:17). Product hostnames are planned behind Access (SPEC.md:89), so the bypass for /healthz belongs with #50.

Acceptance criteria

  • Contract test deep_healthz_reports_the_database returns 200 with the database up and 503 with it unreachable. The control is a Connector that always fails, or a stopped native-pg container.
  • curl -s http://status.woven/api/v1/endpoints/statuses lists the Thrust deep probe with recent results. A deliberate failure (stopping the dev database, or pointing at a wrong path) turns it red within two intervals, and it turns green again afterwards.
  • A 30-day availability figure is read from the probe's Gatus uptime, and SPEC §6.4 and Q-G5.2 name the probe as the SLO source.
  • ADR-0094 carries the exit trigger, Q-0094.4 is answered, and the probe item of Q-0094.7 is closed.

References

  • Review: .agents/plans/contrail/reviews/2026-10-19-fable-architecture-review.md (FR-10)
  • crates/thrust-api/src/lib.rs:132-134,271; crates/thrust-ports/src/lib.rs:92-138
  • ADR-0094 (.agents/plans/contrail/adrs/infra/0094-postgres-hosting-cnpg-tunnel-vpc.md:39,44,58-61); ADR-0141:17; ADR-0130 (Q-0130.3)
  • Q-0094.4 (QUESTIONS.md:303), Q-0094.7 (QUESTIONS.md:339), Q-G5.2 (QUESTIONS.md:299); SPEC §6.4 (SPEC.md:78,83,89)
  • research/0010-thrust-postgres-infra-plan.md:174-187; research/0004-rust-on-workers-binding-matrix.md:389
  • Infra repository: shared/aws/status-page/files/gatus.yaml, infrastructure/.claude/rules/status-page.md
  • Cloudflare docs: hyperdrive/concepts/query-caching

Blocked by: #37

Finding: FR-10

Langage dominant
Rust
Étoiles
0
Forks
0
Merge moyen
1 h 35 min
PR mergées (30 j)
67

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de aRustyDev/thrust

Toutes les issues de aRustyDev/thrust

Issues similaires

Plus d'issues Rust

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.