chore(infra): `GET /healthz?deep=1` through the database and a `status.woven` probe; SLO measured on it

Aperta
  • Qualcosa non va?
#42 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
postgresql, rust
Ambito
backend, databases, observability

Direzione di ricerca

Start with crates/thrust-api/src/lib.rs and the Database port in crates/thrust-ports/src/lib.rs; read the existing /healthz handler and the blocker #37 outcome before choosing the probe path. Check the contract test and the Gatus configuration in the infrastructure repository, since both repositories are involved. Done means the deep probe reports database availability, Gatus records it as the SLO source, and the specified ADR, questions, and spec updates are complete.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area:infra prio:p0 review:fable-2026-10-19

Context

/healthz returns ok without touching the database (crates/thrust-api/src/lib.rs:132-134, mounted at line 271; research/0004:389), and the Database port has no ping method (crates/thrust-ports/src/lib.rs:92-138). status.woven is the Gatus page, configured in shared/aws/status-page/files/gatus.yaml in the infra repository (process: infrastructure/.claude/rules/status-page.md). It does not probe the Thrust database path (research/0010:176). Q-0130.3 was answered in round 18: Gatus probes health and API SLIs (QUESTIONS.md:247). The SLO is 99.5 % availability (SPEC.md:78), which over 30 days allows about 3.6 hours of downtime.

Problem

Product availability now includes:

  • woven-o11y, an observability cluster that was upgraded from 1.32 to 1.37 four days before the Postgres landed, with a primary PodDisruptionBudget of 0 on thrust-pg;
  • the tunnel's cloudflared pods, which both clusters share;
  • a beta Workers VPC (ADR-0094:39; research/0010 §6 risks 1, 2 and 7).

Q-0094.4 (QUESTIONS.md:303) asks whether that is acceptable for the SLO and whether status.woven should probe the path; Q-0094.7 (QUESTIONS.md:339) lists the probe too. Nothing measures the coupling today, so a breach of the budget would go unseen.

Proposal

Answer Q-0094.4 with three conditions (ADR-0094 round-29 note):

  1. Deep probe. GET /healthz?deep=1 on the product hostname runs one statement through the database and returns 200 ok, or 503 with no error detail; plain /healthz stays database-free. Add an untenanted ping to the Database port (under the SystemScope from #35). Use a statement that Hyperdrive never caches, such as SELECT now(): Hyperdrive caches reads that use only IMMUTABLE functions, so select 1 could be answered from its cache on any config with caching enabled (hyperdrive/concepts/query-caching). If #37 picks the Durable Object, the probe goes through the object instead.
  2. Probe and SLO. status.woven probes that URL every 60 s, and the SLO is measured on the probe end to end, so cluster upgrades and tunnel outages count against the budget.
  3. Exit trigger, written into ADR-0094: two breaches of the monthly budget in one quarter, or an EKS upgrade that needs more than the budget, moves the database to ADR-0094 Option 3 (managed Postgres) or to the #37 outcome.

The probed path must stay outside any Access gate. The prober is a non_identity WARP session, and gating a probed host breaks it (ADR-0141:17). Product hostnames are planned behind Access (SPEC.md:89), so the bypass for /healthz belongs with #50.

Acceptance criteria

  • Contract test deep_healthz_reports_the_database returns 200 with the database up and 503 with it unreachable. The control is a Connector that always fails, or a stopped native-pg container.
  • curl -s http://status.woven/api/v1/endpoints/statuses lists the Thrust deep probe with recent results. A deliberate failure (stopping the dev database, or pointing at a wrong path) turns it red within two intervals, and it turns green again afterwards.
  • A 30-day availability figure is read from the probe's Gatus uptime, and SPEC §6.4 and Q-G5.2 name the probe as the SLO source.
  • ADR-0094 carries the exit trigger, Q-0094.4 is answered, and the probe item of Q-0094.7 is closed.

References

  • Review: .agents/plans/contrail/reviews/2026-10-19-fable-architecture-review.md (FR-10)
  • crates/thrust-api/src/lib.rs:132-134,271; crates/thrust-ports/src/lib.rs:92-138
  • ADR-0094 (.agents/plans/contrail/adrs/infra/0094-postgres-hosting-cnpg-tunnel-vpc.md:39,44,58-61); ADR-0141:17; ADR-0130 (Q-0130.3)
  • Q-0094.4 (QUESTIONS.md:303), Q-0094.7 (QUESTIONS.md:339), Q-G5.2 (QUESTIONS.md:299); SPEC §6.4 (SPEC.md:78,83,89)
  • research/0010-thrust-postgres-infra-plan.md:174-187; research/0004-rust-on-workers-binding-matrix.md:389
  • Infra repository: shared/aws/status-page/files/gatus.yaml, infrastructure/.claude/rules/status-page.md
  • Cloudflare docs: hyperdrive/concepts/query-caching

Blocked by: #37

Finding: FR-10

Lingua principale
Rust
Stelle
0
Fork
0
Merge medio
1h 35m
PR unite (30g)
67

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di aRustyDev/thrust

Tutte le issue di aRustyDev/thrust

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.