carverauto/serviceradar

Fork 0

Chore/fixing helm #2443

Merged

mfreeman451 merged 25 commits from refs/pull/2443/head into main

2025-11-22 22:49:56 +00:00

mfreeman451 commented

2025-11-22 07:32:11 +00:00

(Migrated from github.com)

Owner

Imported from GitHub pull request.

Original GitHub pull request: #1975
Original author: @mfreeman451
Original URL: https://github.com/carverauto/serviceradar/pull/1975
Original created: 2025-11-22T07:32:11Z
Original updated: 2025-11-22T22:51:57Z
Original head: carverauto/serviceradar:chore/fixing_helm
Original base: main
Original merged: 2025-11-22T22:49:56Z by @mfreeman451

User description

IMPORTANT: Please sign the Developer Certificate of Origin

Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include
a DCO sign-off statement indicating the DCO acceptance in one commit message. Here
is an example DCO Signed-off-by line in a commit message:

Signed-off-by: J. Doe <j.doe@domain.com>

Describe your changes

Issue ticket number and link

Code checklist before requesting a review

I have signed the DCO?
The build completes without errors?
All tests are passing when running make test?

PR Type

Enhancement, Bug fix, Documentation

Description

Major migration from Proton to CNPG/Timescale database: Removed all Proton-related services, configurations, and references throughout the codebase, replacing them with CNPG/Timescale terminology and configurations
SPIFFE/SPIRE security enhancements: Added SPIFFE support to KV client TLS configuration with retry logic, improved SPIRE agent and server configurations with projected service account tokens (PSAT), and enhanced credential loading resilience
Helm chart improvements: Refactored helpers for SPIFFE and RBAC, added secret auto-generation job, added CNPG application database bootstrap job, updated core and db-event-writer deployments with proper credential management
Database schema updates: Refactored device metrics continuous aggregates (CAGGs) for Timescale 2.24 compatibility, fixed event upsert conflict resolution with composite key
Configuration standardization: Updated default database name from telemetry to serviceradar, added environment variable support for CNPG password injection, updated Docker Compose and Docker images
Documentation updates: Completed CNCF General Technical Review documentation, updated architecture decision records (ADRs) and product requirement documents (PRDs) to reference CNPG, removed Proton-specific TLS and setup documentation
Code quality improvements: Enhanced error handling in zen engine with matches! macro, improved build script error formatting, added packaging rules validation test

Diagram Walkthrough

flowchart LR
  Proton["Proton Database<br/>Removed"]
  CNPG["CNPG/Timescale<br/>Primary Database"]
  SPIFFE["SPIFFE/SPIRE<br/>Security"]
  Helm["Helm Charts<br/>Enhanced"]
  Docs["Documentation<br/>Updated"]
  
  Proton -->|"Migration"| CNPG
  SPIFFE -->|"Integrated into"| Helm
  CNPG -->|"Configured in"| Helm
  Helm -->|"Documented in"| Docs

File Walkthrough

Relevant files

Refactoring

5 files

publisher_test.go `Rename ProtonPublisher to RegistryPublisher in tests` pkg/mapper/publisher_test.go Renamed test function from `TestNewProtonPublisher` to `TestNewRegistryPublisher` Updated all function calls from `NewProtonPublisher` to `NewRegistryPublisher` Changed type casts from `ProtonPublisher` to `RegistryPublisher` Updated variable names from `protonPublisher` to `registryPublisher` throughout test cases	+18/-18
publisher.go `Rename ProtonPublisher to RegistryPublisher struct` pkg/mapper/publisher.go Renamed struct `ProtonPublisher` to `RegistryPublisher` Renamed function `NewProtonPublisher` to `NewRegistryPublisher` Updated all receiver method declarations from `ProtonPublisher` to `RegistryPublisher` Updated struct instantiation and documentation comments	+12/-12
hydrate.go `Replace Proton references with database terminology` pkg/registry/hydrate.go Changed comment references from "Proton" to "database" in hydration functions Updated variable name from `protonCount` to `dbCount` Updated log messages to reference "database" instead of "Proton"	+6/-6
server.go `Update API server comments to use legacy terminology` pkg/core/api/server.go Updated comment from "Proton-based" to "legacy" in `WithDeviceRegistryEnforcement` function Changed error log messages from "Proton fallback" to "legacy fallback"	+3/-3
device_registry.go `Update device registry log messages` pkg/core/api/device_registry.go Updated error log message from "Proton fallback" to "legacy fallback" Updated warning log message to reference "legacy store" instead of "Proton"	+2/-2

Enhancement

14 files

main.go `Add environment variable support for CNPG password` cmd/consumers/db-event-writer/main.go Added `os` package import for environment variable access Added logic to read `CNPG_PASSWORD` from environment if password is empty in config Enables password injection via environment variable for security	+8/-0
lib.rs `Add SPIFFE support to KV client TLS configuration` rust/kvutil/src/lib.rs Added SPIFFE certificate and error handling imports Refactored TLS configuration to support both mTLS and SPIFFE modes Implemented `load_spiffe_tls` function with retry logic and error handling Added `SpiffeSourceGuard` struct for managing SPIFFE credentials Added helper functions for SPIFFE error detection and retry logic Added test for invalid trust domain validation	+182/-18
spiffe.rs `Improve SPIFFE credential loading resilience` cmd/consumers/zen/src/spiffe.rs Refactored SPIFFE credential loading with retry logic and exponential backoff Added error mapping function for gRPC errors Improved error handling for source and TLS material errors Added helper functions to detect retryable errors Enhanced logging with retry information	+99/-24
message_processor.rs `Improve zen engine error handling` cmd/consumers/zen/src/message_processor.rs Refactored error handling to use `matches!` macro for cleaner pattern matching Improved error context messages for rule evaluation failures Enhanced error reporting with specific failure reasons	+16/-6
_helpers.tpl `Refactor Helm helpers for SPIFFE and RBAC` helm/serviceradar/templates/_helpers.tpl Reorganized helper templates for better structure Added new `serviceradar.kvServerSPIFFEID` helper template Added new `serviceradar.coreServerSPIFFEID` helper template Added RBAC helper templates for SPIRE cluster roles and bindings Moved `serviceradar.kvEnv` template and refactored to use new SPIFFE ID helper	+60/-20
secret-generator-job.yaml `Add Helm secret auto-generation job for deployment` helm/serviceradar/templates/secret-generator-job.yaml New Helm hook job that auto-generates required secrets (`jwt-secret`, `api-key`, `admin-password`, `admin-bcrypt-hash`, `edge-onboarding-key`) Implements idempotent secret creation and patching logic using Kubernetes API calls Runs as pre-install/pre-upgrade hook with proper RBAC (ServiceAccount, Role, RoleBinding) Supports optional override of edge onboarding key via environment variable	+214/-0
cnpg-app-bootstrap-job.yaml `Add CNPG application database bootstrap job` helm/serviceradar/templates/cnpg-app-bootstrap-job.yaml New post-install/post-upgrade Helm job that bootstraps CNPG application database and user Creates `serviceradar` database and application role with proper privileges Mounts CNPG CA certificate for secure TLS connections Stores credentials in a dedicated `serviceradar-db-credentials` secret	+159/-0
core.yaml `Update core deployment for CNPG and credential management` helm/serviceradar/templates/core.yaml Added `serviceradar-core` ServiceAccount creation Updated CNPG environment variables to use configurable values with defaults Changed database credentials to use `serviceradar-db-credentials` secret instead of `cnpg-superuser` Added CNPG CA certificate volume mount and environment variable Added `EDGE_ONBOARDING_ENCRYPTION_KEY` from secrets Simplified health probes from gRPC to TCP socket checks Added persistent volume claim for core data storage	+56/-34
00000000000003_device_metrics_summary_cagg.up.sql `Refactor device metrics CAGGs for Timescale compatibility` pkg/db/cnpg/migrations/00000000000003_device_metrics_summary_cagg.up.sql Refactored device metrics continuous aggregate into three separate single-hypertable CAGGs (`device_metrics_summary_cpu`, `device_metrics_summary_disk`, `device_metrics_summary_memory`) Created a composite view that joins the three CAGGs to maintain backward compatibility Added proper Timescale CAGG policies and retention policies for each metric type Ensures compatibility with Timescale 2.24 CAGG constraints	+91/-51
db-event-writer.yaml `Update db-event-writer for CNPG and SPIFFE configuration` helm/serviceradar/templates/db-event-writer.yaml Added CNPG CA certificate volume mount Updated CNPG connection environment variables to use configurable values Changed database credentials to use `serviceradar-db-credentials` secret Added comprehensive KV and Core client configuration environment variables Added `SPIFFE_ENDPOINT_SOCKET` for proper SPIFFE workload API initialization Added `ENABLE_DB_MIGRATIONS` flag	+51/-5
spire-server.yaml `Update SPIRE server for PSAT and multi-namespace support` helm/serviceradar/templates/spire-server.yaml Added `tokenAudience` configuration for SPIRE token validation Changed NodeAttestor from `k8s_sat` to `k8s_psat` (projected service account tokens) Added support for multiple agent namespaces via `additionalAgentNamespaces` Made controller manager and webhooks conditionally enabled Updated RBAC resource names to use helper functions for consistency Added token review audience configuration	+31/-7
00000000000005_device_metrics_summary_cagg_fix.up.sql `Add CAGG rebuild migration for Timescale compatibility` pkg/db/cnpg/migrations/00000000000005_device_metrics_summary_cagg_fix.up.sql New migration that rebuilds device metrics CAGGs to match single-hypertable design Drops and recreates three separate CAGGs with proper Timescale constraints Creates composite view joining the three CAGGs for backward compatibility Idempotent migration for clusters that already have version 0003	+118/-0
spire-agent.yaml `Update SPIRE agent for PSAT and token projection` helm/serviceradar/templates/spire-agent.yaml Changed NodeAttestor from `k8s_sat` to `k8s_psat` (projected service account tokens) Added `tokenAudience` configuration for token validation Added cleanup init container to remove stale agent socket Added projected service account token volume mount Changed node name field reference from `status.podIP` to `spec.nodeName` Added `automountServiceAccountToken: true` and `dnsPolicy:` `ClusterFirstWithHostNet` Updated RBAC resource names to use helper functions	+30/-5
00000000000005_device_metrics_summary_cagg_fix.up.sql `Add device metrics CAGG rebuild migration` pkg/db/cnpg/migrations/00000000000005_device_metrics_summary_cagg_fix.up.sql New migration file that rebuilds device metrics CAGGs for Timescale compatibility Drops and recreates three single-hypertable CAGGs with proper constraints Creates composite view joining the three CAGGs Handles idempotent migration for clusters with version 0003	+118/-0

Configuration changes

13 files

main.go `Update default CNPG database name` cmd/tools/cnpg-migrate/main.go Changed default database name from "telemetry" to "serviceradar"	+1/-1
tools-profile.sh `Remove Proton references from Docker Compose` docker/compose/tools-profile.sh Removed all Proton-related environment variables and aliases Updated default CNPG database from "telemetry" to "serviceradar" Removed Proton CLI aliases and helper functions Removed Proton certificate generation and connectivity checks	+3/-44
generate-certs.sh `Simplify certificate generation for non-Proton setup` docker/compose/generate-certs.sh Simplified certificate permission handling by removing Proton-specific logic Removed special handling for uid 999 (Proton user) Unified certificate ownership to serviceradar user	+2/-37
entrypoint-certs.sh `Remove Proton certificate generation` docker/compose/entrypoint-certs.sh Removed Proton certificate generation from certificate check condition Removed generation of Proton-specific certificates Removed copying of core certificates for Proton use	+2/-10
entrypoint-srql.sh `Update SRQL entrypoint database name` docker/compose/entrypoint-srql.sh Updated default CNPG database from "telemetry" to "serviceradar"	+1/-1
BUILD.bazel `Update flowgger base image to Debian` docker/images/BUILD.bazel Changed flowgger image base from `ubuntu_noble_linux_amd64` to `debian_testing_slim_linux_amd64`	+1/-72
db-event-writer.docker.json `Update db-event-writer database configuration` docker/compose/db-event-writer.docker.json Updated default CNPG database name from "telemetry" to "serviceradar"	+1/-1
serviceradar-config.yaml `Helm configuration templating and OTEL service integration` helm/serviceradar/files/serviceradar-config.yaml Added `$otelSA` template variable for OTEL service account configuration Replaced hardcoded values with Helm template variables for `trustDomain`, `spireNamespace`, and CNPG configuration Updated CNPG database defaults from `telemetry` to `serviceradar` and added CA file path templating Added `edge_onboarding.encryption_key` templating and updated security configurations to use template variables Reformatted entire configuration file with consistent indentation and spacing Added new service configurations: `otel.toml`, `trapd.json`, `sync.json`, `faker.json`, `rperf.json`, and updated `datasvc.json` with NATS security and OTEL service account RBAC Updated `core-k8s-init.sh` to support edge onboarding encryption key and CNPG CA file configuration	+1237/-1402
docker-compose.yml `Remove Proton database service from Docker Compose` docker-compose.yml Removed entire Proton (TimeBase) database service and related containers (`proton`, `credentials-permissions-fixer`) Removed Proton-related environment variables and dependencies from core service Updated CNPG database name default from `telemetry` to `serviceradar` Simplified core service dependencies by removing Proton health checks and credential permissions fixer	+1/-90
docker-compose.dev.yml `Remove Proton service from Docker Compose` docker-compose.dev.yml Removed entire Proton service definition including ports, volumes, environment variables, and health checks Removed Proton dependency from core service Updated core service comments to reference CNPG instead of Proton Removed Proton-related environment variables from core	+1/-56
values.yaml `Update Helm values for CNPG and SPIRE configuration` helm/serviceradar/values.yaml Removed `proton` image tag from configuration Updated `flowgger` image tag to `1.0.56` (fixed OpenSSL version) Added comprehensive `cnpg` configuration section with host, port, database, credentials, and TLS settings Added `agent` resource limits and requests configuration Added `dbEventWriter` configuration with config source and KV bootstrap options Added `tokenAudience` and `additionalAgentNamespaces` to SPIRE configuration Added `otelServiceAccount` to SPIRE service accounts Enabled SPIRE controller manager by default Removed entire `proton` resource and storage configuration section Added `secrets.autoGenerate` and `secrets.edgeOnboardingKey` configuration	+30/-13
Makefile.docker `Remove Proton targets from Docker Makefile` Makefile.docker Updated help text to remove Proton references Removed `logs-proton` and `db-shell` make targets Updated `up` target to start only core service instead of core + proton Removed `db-query` and `docker-build-proton` targets Updated test target to remove Proton health check Updated status output to remove Proton references	+5/-23
db-event-writer.json `Update db-event-writer config for serviceradar database` packaging/event-writer/config/db-event-writer.json Updated CNPG database name from `telemetry` to `serviceradar` Updated CNPG username from `postgres` to `serviceradar`	+2/-2

Documentation

31 files

diagnostics.go `Update diagnostics documentation terminology` pkg/registry/diagnostics.go Updated comment to reference "database" instead of "Proton" in `SampleMissingDeviceIDs` documentation	+3/-3
discovery.go `Update discovery model comment terminology` pkg/models/discovery.go Updated comment for `LocalIfIndex` field from "Proton driver" to "Postgres driver"	+1/-1
time_utils.go `Update timestamp validation comment` pkg/core/time_utils.go Updated comment to reference "database's supported range" instead of "Proton"	+1/-1
sanitize.go `Update metadata size limit comment` pkg/deviceupdate/sanitize.go Updated comment to reference "CNPG row limits" instead of "Proton row limits"	+1/-1
stats.go `Update stats model documentation` pkg/models/stats.go Updated comment to reference "warehouse" instead of "Proton" for device stats computation	+1/-1
device_transform.go `Update device transform documentation` pkg/registry/device_transform.go Updated comment to remove "Proton" reference in device record creation documentation	+1/-1
device.go `Update device registry comment` pkg/registry/device.go Updated comment to reference "CNPG store" instead of "Proton" for device hydration	+1/-1
traceTimestamp.test.ts `Update web test descriptions terminology` web/src/utils/traceTimestamp.test.ts Updated test descriptions from "Proton DateTime64" to "legacy DateTime64" Updated test descriptions from "Proton-formatted" to "legacy formatted"	+2/-2
streaming-client.ts `Update streaming client log message` web/src/lib/streaming-client.ts Updated console log message from "Proton batch completion" to "legacy batch completion" Added newline at end of file	+2/-2
traceTimestamp.ts `Update timestamp normalization documentation` web/src/utils/traceTimestamp.ts Updated JSDoc comment to reference "legacy DateTime64-style values" instead of "Proton"	+1/-1
fix-cert-permissions.sh `Update certificate permissions comment` docker/compose/fix-cert-permissions.sh Updated comment to reference "database containers" instead of "Proton"	+2/-2
CNCF_GTR.md `Complete CNCF General Technical Review documentation` docs/LF/CNCF_GTR.md Updated project metadata with version 1.0.56 and website URL Filled in all Day 0 planning phase sections with detailed project information Completed Day 1 installation and deployment phase documentation Completed Day 2 operations phase with scalability, observability, and compliance details Added comprehensive security and threat modeling information Documented architecture, dependencies, and troubleshooting procedures	+168/-90
ADR-02.md `Update ADR-02 to reference CNPG instead of Proton` sr-architecture-and-design/adr/ADR-02.md Replaced all "Proton" references with "CNPG" or "CNPG/Timescale" Updated architecture description to reflect CNPG as primary streaming engine Updated implementation plan and consequences sections Maintained all technical design details while updating terminology	+37/-37
06-snmp-discovery.md `Update SNMP discovery PRD to reference CNPG` sr-architecture-and-design/prd/06-snmp-discovery.md Replaced all "Proton" references with "CNPG" or "CNPG/Timescale" Updated data pipeline descriptions to reference CNPG streams Updated diagrams and flow descriptions Maintained all functional requirements and specifications	+21/-21
tls-security.md `Remove Proton TLS configuration documentation` docs/docs/tls-security.md Removed all Proton-specific TLS configuration sections Removed Proton certificate deployment instructions Removed Proton configuration examples Updated certificate overview to remove Proton references Removed Proton verification and troubleshooting steps Simplified certificate deployment to focus on CNPG and ServiceRadar components	+11/-129
CHANGELOG `Add ServiceRadar v1.0.56 release notes` CHANGELOG Added new version entry for ServiceRadar v1.0.56 with highlights on flowgger OpenSSL fix and agent/poller stability improvements Documented CNPG app bootstrap job for automatic database and user creation Noted removal of init-container hack and TCP probe improvements Updated resource requests/limits for agent and poller components	+12/-24
DOCKER_QUICKSTART.md `Update Docker quickstart documentation for Proton removal` DOCKER_QUICKSTART.md Updated quick start description to remove Proton database references Removed Proton HTTP and Native port endpoints from available services list Simplified service startup description to focus on core stack (CNPG, NATS, web, API) Removed Proton from "What's Running?" section	+2/-6
CNCF_DAY0.md `Replace Proton database references with CNPG/Timescale` docs/CNCF/CNCF_DAY0.md Replaced all references to `Timeplus Proton` with `CNPG/Timescale` throughout the documentation Updated architecture diagrams and component descriptions to reflect the new database technology Removed Proton-specific configuration examples (e.g., `proton.resources.memory` Helm parameter) Updated database storage and query references to use CNPG/Timescale terminology	+17/-18
docker-setup.md `Update Docker setup documentation for CNPG migration` docs/docs/docker-setup.md Removed all Proton database references and replaced with CNPG/Postgres tooling Updated database maintenance section to use `psql` instead of Proton client Removed Proton-specific backup/restore procedures and volume references Updated troubleshooting section to use Postgres connection strings Removed Proton service from Docker Compose dependency graph	+17/-65
project.md `Update project context documentation for CNPG` openspec/project.md Replaced `Timeplus Proton` references with `CNPG/Timescale` throughout project context Updated tech stack description to reflect Postgres hypertables instead of Proton streams Updated data layer and analytics descriptions to use CNPG terminology Changed external dependencies section to reference CNPG/TimescaleDB	+7/-7
docker-setup.md `Remove Proton references from Docker setup` docs/docs/docker-setup.md Removed Proton service configuration and health checks Updated configuration references from Proton to CNPG Removed Proton-specific ports and volume definitions Updated performance tuning section to reference CNPG instead of Proton	+17/-65
04-device-mgmt.md `Update device management PRD for CNPG database` sr-architecture-and-design/prd/04-device-mgmt.md Replaced all `Proton` database references with `CNPG` Updated data pipeline descriptions to reference CNPG streams instead of Proton streams Changed materialized view and deduplication strategy descriptions to use CNPG terminology Updated phase descriptions to reference CNPG stream processing	+9/-9
agents.md `Update agents documentation for CNPG database naming` docs/docs/agents.md Updated CNPG migration documentation to reference `serviceradar` database instead of `telemetry` Updated connection examples and environment variable documentation Changed database extension setup instructions to use `serviceradar` database Updated all references from Proton to CNPG/Timescale	+11/-11
CNCF_security_self_assessment.md `Update security assessment for CNPG migration` docs/CNCF/CNCF_security_self_assessment.md Removed `serviceradar-proton` from actors list Updated `db-event-writer` description to reference CNPG database instead of Proton Updated `serviceradar-rperf-checker` to reference CNPG database Updated `serviceradar-tools` description to reference CNPG instead of Proton Updated security controls section to reference CNPG instead of Proton	+4/-5
07-cdp-discovery.md `Update CDP discovery PRD for CNPG database` sr-architecture-and-design/prd/07-cdp-discovery.md Replaced all `Proton` stream references with `CNPG` stream references Updated data output and storage section heading from Proton to CNPG Updated architecture diagrams to reference CNPG/Timescale instead of Timeplus Proton Updated data models section heading to reference CNPG	+10/-10
09-bgp-discovery.md `Update BGP discovery PRD for CNPG database` sr-architecture-and-design/prd/09-bgp-discovery.md Replaced all `Proton` stream references with `CNPG` stream references Updated data output and storage section heading from Proton to CNPG Updated architecture diagrams to reference CNPG/Timescale instead of Timeplus Proton Updated data models section heading to reference CNPG	+10/-10
08-lldp-discovery.md `Update LLDP discovery PRD for CNPG database` sr-architecture-and-design/prd/08-lldp-discovery.md Replaced all `Proton` stream references with `CNPG` stream references Updated data output and storage section heading from Proton to CNPG Updated architecture diagrams to reference CNPG/Timescale instead of Timeplus Proton Updated data models section heading to reference CNPG	+10/-10
README.md `Update Docker README for CNPG migration` docker/README.md Removed all Proton database references and configuration details Updated component descriptions to remove Proton Removed Proton-specific security and health check sections Updated configuration file references from Proton to CNPG Removed Proton ports and volume definitions Updated troubleshooting section to use Postgres connection strings Removed Proton-specific development commands	+10/-36
tasks.md `Add Helm demo chart update tasks documentation` openspec/changes/update-helm-demo-chart/tasks.md New file documenting implementation tasks for Helm demo chart updates Lists completed tasks for CNPG migration, SPIRE alignment, and secret generation Documents validation steps and recent fixes for db-event-writer and SPIFFE Includes notes on current blockers and TODO items for app database bootstrap	+41/-0
agents.md `Update agents documentation for CNPG database` docs/docs/agents.md Updated database name references from `telemetry` to `serviceradar` Updated CNPG migration documentation and examples Updated extension setup instructions for serviceradar database Updated all Proton references to CNPG/Timescale	+11/-11
AGENTS.md `Update AGENTS.md for CNPG migration` AGENTS.md Replaced `Proton/Timeplus` with `CNPG/Timescale` in project overview Updated repository layout description to reference CNPG instead of Proton Updated operational runbooks reference to use CNPG terminology Removed Proton SQL helper command example	+3/-11

Bug fix

1 files

events.go

Fix event upsert conflict resolution

pkg/db/events.go

Modified ON CONFLICT clause to include both id and event_timestamp
columns
Ensures proper conflict resolution for event upserts

+1/-1

Tests

1 files

tests.rs

Add packaging rules validation test

cmd/consumers/zen/src/tests.rs

Added new test packaging_rules_parse to validate all packaging rules
JSON files
Ensures all rule files in packaging directory parse correctly

+27/-0

Formatting

1 files

build.rs

Improve build script error handling

cmd/checkers/rperf-client/build.rs

Improved error handling formatting for RUNFILES_DIR environment
variable check
Better code readability with multi-line error construction

+6/-1

Dependencies

1 files

MODULE.bazel

Update Bazel module dependencies for CNPG migration

MODULE.bazel

Added debian_testing_slim OCI image pull for Debian testing base
Removed timeplus_proton OCI image pull and related configuration
Reordered http_archive attributes for cmake_linux_amd64_prebuilt for
consistency

+15/-28

Additional files

101 files

sbom-syft.yml	+36/-0
Cargo.toml	+0/-1
ROADMAP.md	+2/-2
VERSION	+1/-1
Dockerfile	+1/-3
config.json	+4/-4
config.json	+4/-4
Dockerfile	+1/-3
BUILD.bazel	+0/-27
Cargo.toml	+0/-28
README.md	+0/-183
build.rs	+0/-34
poller-ng.json	+0/-61
adapter.rs	+0/-640
main.rs	+0/-165
mod.rs	+0/-20
types.rs	+0/-101
processor.rs	+0/-68
mod.rs	+0/-21
rperf.rs	+0/-121
snmp.rs	[link]
sysmon.rs	+0/-190
BUILD.bazel	+0/-35
monitoring.proto	+0/-79
Dockerfile	+1/-3
docker-compose.override.yml.example	+2/-2
LOCAL_BUILD.md	+1/-3
BUILD.bazel	+0/-22
Dockerfile.flowgger	+0/-1
Dockerfile.otel	+0/-1
Dockerfile.proton	+0/-99
Dockerfile.tools	+1/-3
Dockerfile.trapd	+0/-1
Dockerfile.zen.optimized	+3/-5
entrypoint-core.sh	+0/-40
fix-credentials-permissions.sh	+0/-38
proton-cli.sh	+0/-2
proton-client-config.xml	+0/-18
proton-client.sh	+0/-76
proton-info.sh	+0/-33
proton-init.sh	+0/-167
proton-limits.conf	+0/-4
proton-openssl.xml	+0/-9
proton-sql.sh	+0/-12
proton-sysctl.conf	+0/-3
proton-wrapper.sh	+0/-46
tools-motd.txt	+1/-12
push_targets.bzl	+0/-1
Dockerfile.rpm.proton	+0/-82
Dockerfile.rpm.rust.flowgger	+0/-1
Dockerfile.rpm.rust.otel	+0/-1
Dockerfile.rpm.rust.trapd	+0/-1
Dockerfile.rpm.rust.zen	+0/-1
CNCF_Pre_check.md	+2/-7
LF_Github_Recommendations.md	+10/-9
LF_SECURITY_CHECK.md	+10/-8
SBOM.spdx	+1/-167669
repo_lint.md	+38942/-3
third-party-deps.html	[link]
armis.md	+1/-1
cnpg-monitoring.md	+1/-1
discovery.md	+3/-3
edge-agent-onboarding.md	+3/-3
netflow.md	+3/-3
otel.md	+2/-2
proton.md	+0/-318
search-planner-operations.md	+1/-1
service-registry-design.md	+1/-1
service-registry-status.md	+3/-3
srql-language-reference.md	+1/-1
troubleshooting-guide.md	+2/-2
querying-service-config.md	+2/-2
sidebars.ts	+0/-1
README.md	+6/-32
generate-certs.sh	+0/-1
agent.yaml	+8/-4
datasvc.yaml	+10/-0
db-event-writer-config.yaml	+6/-4
db-event-writer-kv-bootstrap-job.yaml	+57/-0
flowgger.yaml	+4/-4
nats.yaml	+7/-5
otel.yaml	+6/-0
poller.yaml	+13/-12
proton.yaml	+0/-136
spire-clusterspiffeids.yaml	+3/-2
spire-controller-manager-rbac.yaml	+3/-3
spire-postgres.yaml	+25/-2
configmap.yaml	+1/-1
serviceradar-tools.yaml	+1/-1
proposal.md	+20/-0
spec.md	+33/-0
core.docker.json	+23/-23
core.json	+4/-4
BUILD.bazel	+0/-1
BUILD.bazel	+0/-7
config.yaml	+0/-630
grok-patterns	+0/-94
users.yaml	+0/-161
package.sh	+0/-194
postinstall.sh	+0/-256
Additional files not shown

Imported from GitHub pull request. Original GitHub pull request: #1975 Original author: @mfreeman451 Original URL: https://github.com/carverauto/serviceradar/pull/1975 Original created: 2025-11-22T07:32:11Z Original updated: 2025-11-22T22:51:57Z Original head: carverauto/serviceradar:chore/fixing_helm Original base: main Original merged: 2025-11-22T22:49:56Z by @mfreeman451 --- ### **User description** ## IMPORTANT: Please sign the Developer Certificate of Origin Thank you for your contribution to ServiceRadar. Please note, when contributing, the developer must include a [DCO sign-off statement]( https://developercertificate.org/) indicating the DCO acceptance in one commit message. Here is an example DCO Signed-off-by line in a commit message: ``` Signed-off-by: J. Doe <j.doe@domain.com> ``` ## Describe your changes ## Issue ticket number and link ## Code checklist before requesting a review - [ ] I have signed the DCO? - [ ] The build completes without errors? - [ ] All tests are passing when running make test? ___ ### **PR Type** Enhancement, Bug fix, Documentation ___ ### **Description** - **Major migration from Proton to CNPG/Timescale database**: Removed all Proton-related services, configurations, and references throughout the codebase, replacing them with CNPG/Timescale terminology and configurations - **SPIFFE/SPIRE security enhancements**: Added SPIFFE support to KV client TLS configuration with retry logic, improved SPIRE agent and server configurations with projected service account tokens (PSAT), and enhanced credential loading resilience - **Helm chart improvements**: Refactored helpers for SPIFFE and RBAC, added secret auto-generation job, added CNPG application database bootstrap job, updated core and db-event-writer deployments with proper credential management - **Database schema updates**: Refactored device metrics continuous aggregates (CAGGs) for Timescale 2.24 compatibility, fixed event upsert conflict resolution with composite key - **Configuration standardization**: Updated default database name from `telemetry` to `serviceradar`, added environment variable support for CNPG password injection, updated Docker Compose and Docker images - **Documentation updates**: Completed CNCF General Technical Review documentation, updated architecture decision records (ADRs) and product requirement documents (PRDs) to reference CNPG, removed Proton-specific TLS and setup documentation - **Code quality improvements**: Enhanced error handling in zen engine with `matches!` macro, improved build script error formatting, added packaging rules validation test ___ ### Diagram Walkthrough ```mermaid flowchart LR Proton["Proton Database Removed"] CNPG["CNPG/Timescale Primary Database"] SPIFFE["SPIFFE/SPIRE Security"] Helm["Helm Charts Enhanced"] Docs["Documentation Updated"] Proton -->|"Migration"| CNPG SPIFFE -->|"Integrated into"| Helm CNPG -->|"Configured in"| Helm Helm -->|"Documented in"| Docs ``` <details> <summary><h3> File Walkthrough</h3></summary> <table><thead><tr><th></th><th align="left">Relevant files</th></tr></thead><tbody><tr><td>Refactoring</td><td><details><summary>5 files</summary><table> <tr> <td> <details> <summary>publisher_test.go<dd><code>Rename ProtonPublisher to RegistryPublisher in tests</code>          </dd></summary> <hr> pkg/mapper/publisher_test.go <ul><li>Renamed test function from <code>TestNewProtonPublisher</code> to <code>TestNewRegistryPublisher</code> <li> Updated all function calls from <code>NewProtonPublisher</code> to <code>NewRegistryPublisher</code> <li> Changed type casts from <code>*ProtonPublisher</code> to <code>*RegistryPublisher</code> <li> Updated variable names from <code>protonPublisher</code> to <code>registryPublisher</code> throughout test cases</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d517c045db1ac81166cd07733bf1d4bebe1b33b4ac9648a109dbe1280650cc4f">+18/-18</a>  </td> </tr> <tr> <td> <details> <summary>publisher.go<dd><code>Rename ProtonPublisher to RegistryPublisher struct</code>              </dd></summary> <hr> pkg/mapper/publisher.go <ul><li>Renamed struct <code>ProtonPublisher</code> to <code>RegistryPublisher</code> <li> Renamed function <code>NewProtonPublisher</code> to <code>NewRegistryPublisher</code> <li> Updated all receiver method declarations from <code>*ProtonPublisher</code> to <code>*RegistryPublisher</code> <li> Updated struct instantiation and documentation comments</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e27214bea0ae4e8b6aa863949ef883c936437a5021cedbf6c3ee5bdfda3a24dc">+12/-12</a>  </td> </tr> <tr> <td> <details> <summary>hydrate.go<dd><code>Replace Proton references with database terminology</code>            </dd></summary> <hr> pkg/registry/hydrate.go <ul><li>Changed comment references from "Proton" to "database" in hydration functions <li> Updated variable name from <code>protonCount</code> to <code>dbCount</code> <li> Updated log messages to reference "database" instead of "Proton"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e27e237716b5830731f55caab246c132a8ba98f3b37fe5e39de3867038941e4d">+6/-6</a>      </td> </tr> <tr> <td> <details> <summary>server.go<dd><code>Update API server comments to use legacy terminology</code>          </dd></summary> <hr> pkg/core/api/server.go <ul><li>Updated comment from "Proton-based" to "legacy" in <code>WithDeviceRegistryEnforcement</code> function <li> Changed error log messages from "Proton fallback" to "legacy fallback"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1bb99367fdd853c728b7cfbf5893a293f6d217144dfb5282cb8dd32e5261021e">+3/-3</a>      </td> </tr> <tr> <td> <details> <summary>device_registry.go<dd><code>Update device registry log messages</code>                                            </dd></summary> <hr> pkg/core/api/device_registry.go <ul><li>Updated error log message from "Proton fallback" to "legacy fallback" <li> Updated warning log message to reference "legacy store" instead of "Proton"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-34b7da1b2845de83ee2b0eeba93ef1c8b7abf40517f20617c861abffec32ee1c">+2/-2</a>      </td> </tr> </table></details></td></tr><tr><td>Enhancement</td><td><details><summary>14 files</summary><table> <tr> <td> <details> <summary>main.go<dd><code>Add environment variable support for CNPG password</code>              </dd></summary> <hr> cmd/consumers/db-event-writer/main.go <ul><li>Added <code>os</code> package import for environment variable access <li> Added logic to read <code>CNPG_PASSWORD</code> from environment if password is empty in config <li> Enables password injection via environment variable for security</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c9a73828b631e4618af51a47bc4c618d72ad1726fef3c3cbe12ab73b57b0eb63">+8/-0</a>      </td> </tr> <tr> <td> <details> <summary>lib.rs<dd><code>Add SPIFFE support to KV client TLS configuration</code>                </dd></summary> <hr> rust/kvutil/src/lib.rs <ul><li>Added SPIFFE certificate and error handling imports <li> Refactored TLS configuration to support both mTLS and SPIFFE modes <li> Implemented <code>load_spiffe_tls</code> function with retry logic and error handling <li> Added <code>SpiffeSourceGuard</code> struct for managing SPIFFE credentials <li> Added helper functions for SPIFFE error detection and retry logic <li> Added test for invalid trust domain validation</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-91f4558d22540a64796ec2ad9844eaaec577d90b0d8d2738eea0d2041837ead7">+182/-18</a></td> </tr> <tr> <td> <details> <summary>spiffe.rs<dd><code>Improve SPIFFE credential loading resilience</code>                          </dd></summary> <hr> cmd/consumers/zen/src/spiffe.rs <ul><li>Refactored SPIFFE credential loading with retry logic and exponential backoff <li> Added error mapping function for gRPC errors <li> Improved error handling for source and TLS material errors <li> Added helper functions to detect retryable errors <li> Enhanced logging with retry information</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-0daf4a86d7df1cacd92f6e1d97d152efc02687caad0f32eac1fcec9ebdcbe378">+99/-24</a>  </td> </tr> <tr> <td> <details> <summary>message_processor.rs<dd><code>Improve zen engine error handling</code>                                                </dd></summary> <hr> cmd/consumers/zen/src/message_processor.rs <ul><li>Refactored error handling to use <code>matches!</code> macro for cleaner pattern matching <li> Improved error context messages for rule evaluation failures <li> Enhanced error reporting with specific failure reasons</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9fcbc5358a9009e60a8cd22d21e5a9ea652787c727732d0b869e0865495114c3">+16/-6</a>    </td> </tr> <tr> <td> <details> <summary>_helpers.tpl<dd><code>Refactor Helm helpers for SPIFFE and RBAC</code>                                </dd></summary> <hr> helm/serviceradar/templates/_helpers.tpl <ul><li>Reorganized helper templates for better structure <li> Added new <code>serviceradar.kvServerSPIFFEID</code> helper template <li> Added new <code>serviceradar.coreServerSPIFFEID</code> helper template <li> Added RBAC helper templates for SPIRE cluster roles and bindings <li> Moved <code>serviceradar.kvEnv</code> template and refactored to use new SPIFFE ID helper</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-3d59d815f528d134e097ce2c3e830c6eaa738e27b6645df1e9b18136cd5d3c0d">+60/-20</a>  </td> </tr> <tr> <td> <details> <summary>secret-generator-job.yaml<dd><code>Add Helm secret auto-generation job for deployment</code>              </dd></summary> <hr> helm/serviceradar/templates/secret-generator-job.yaml <ul><li>New Helm hook job that auto-generates required secrets (<code>jwt-secret</code>, <code>api-key</code>, <code>admin-password</code>, <code>admin-bcrypt-hash</code>, <code>edge-onboarding-key</code>) <li> Implements idempotent secret creation and patching logic using Kubernetes API calls <li> Runs as pre-install/pre-upgrade hook with proper RBAC (ServiceAccount, Role, RoleBinding) <li> Supports optional override of edge onboarding key via environment variable</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1556faaaf158a59027d25fb5d10241821097d996189838a5129592c08ee42547">+214/-0</a>  </td> </tr> <tr> <td> <details> <summary>cnpg-app-bootstrap-job.yaml<dd><code>Add CNPG application database bootstrap job</code>                            </dd></summary> <hr> helm/serviceradar/templates/cnpg-app-bootstrap-job.yaml <ul><li>New post-install/post-upgrade Helm job that bootstraps CNPG application database and user <li> Creates <code>serviceradar</code> database and application role with proper privileges <li> Mounts CNPG CA certificate for secure TLS connections <li> Stores credentials in a dedicated <code>serviceradar-db-credentials</code> secret</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-20353b2d8b5d8d6f1a2d9d59b56be8206c8aa63728f43f7a1b031b9d46241161">+159/-0</a>  </td> </tr> <tr> <td> <details> <summary>core.yaml<dd><code>Update core deployment for CNPG and credential management</code></dd></summary> <hr> helm/serviceradar/templates/core.yaml <ul><li>Added <code>serviceradar-core</code> ServiceAccount creation <li> Updated CNPG environment variables to use configurable values with defaults <li> Changed database credentials to use <code>serviceradar-db-credentials</code> secret instead of <code>cnpg-superuser</code> <li> Added CNPG CA certificate volume mount and environment variable <li> Added <code>EDGE_ONBOARDING_ENCRYPTION_KEY</code> from secrets <li> Simplified health probes from gRPC to TCP socket checks <li> Added persistent volume claim for core data storage</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-06ab387d2c169d82a1de28b5e66c86f0417bd81b82a96246d0a2da8bfaa8d224">+56/-34</a>  </td> </tr> <tr> <td> <details> <summary>00000000000003_device_metrics_summary_cagg.up.sql<dd><code>Refactor device metrics CAGGs for Timescale compatibility</code></dd></summary> <hr> pkg/db/cnpg/migrations/00000000000003_device_metrics_summary_cagg.up.sql <ul><li>Refactored device metrics continuous aggregate into three separate single-hypertable CAGGs (<code>device_metrics_summary_cpu</code>, <code>device_metrics_summary_disk</code>, <code>device_metrics_summary_memory</code>) <li> Created a composite view that joins the three CAGGs to maintain backward compatibility <li> Added proper Timescale CAGG policies and retention policies for each metric type <li> Ensures compatibility with Timescale 2.24 CAGG constraints</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2b27e967aa26ea0a3206be17c023c2f45b18416cc6be1118053832960172d063">+91/-51</a>  </td> </tr> <tr> <td> <details> <summary>db-event-writer.yaml<dd><code>Update db-event-writer for CNPG and SPIFFE configuration</code>  </dd></summary> <hr> helm/serviceradar/templates/db-event-writer.yaml <ul><li>Added CNPG CA certificate volume mount <li> Updated CNPG connection environment variables to use configurable values <li> Changed database credentials to use <code>serviceradar-db-credentials</code> secret <li> Added comprehensive KV and Core client configuration environment variables <li> Added <code>SPIFFE_ENDPOINT_SOCKET</code> for proper SPIFFE workload API initialization <li> Added <code>ENABLE_DB_MIGRATIONS</code> flag</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e4f899d11e5720f7049aa6fd632bd6993739410051bf65bc6fc8469739e5d2e4">+51/-5</a>    </td> </tr> <tr> <td> <details> <summary>spire-server.yaml<dd><code>Update SPIRE server for PSAT and multi-namespace support</code>  </dd></summary> <hr> helm/serviceradar/templates/spire-server.yaml <ul><li>Added <code>tokenAudience</code> configuration for SPIRE token validation <li> Changed NodeAttestor from <code>k8s_sat</code> to <code>k8s_psat</code> (projected service account tokens) <li> Added support for multiple agent namespaces via <code>additionalAgentNamespaces</code> <li> Made controller manager and webhooks conditionally enabled <li> Updated RBAC resource names to use helper functions for consistency <li> Added token review audience configuration</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7959f7b987adcd56306fe5ddf31fed367dd9bb995f9b82a8fa53553dac8e7077">+31/-7</a>    </td> </tr> <tr> <td> <details> <summary>00000000000005_device_metrics_summary_cagg_fix.up.sql<dd><code>Add CAGG rebuild migration for Timescale compatibility</code>      </dd></summary> <hr> pkg/db/cnpg/migrations/00000000000005_device_metrics_summary_cagg_fix.up.sql <ul><li>New migration that rebuilds device metrics CAGGs to match single-hypertable design <li> Drops and recreates three separate CAGGs with proper Timescale constraints <li> Creates composite view joining the three CAGGs for backward compatibility <li> Idempotent migration for clusters that already have version 0003</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2214c732dd7ffe7877dd9cad923ac3059754eb2b17d8bc16457a0b7b55e23c9e">+118/-0</a>  </td> </tr> <tr> <td> <details> <summary>spire-agent.yaml<dd><code>Update SPIRE agent for PSAT and token projection</code>                  </dd></summary> <hr> helm/serviceradar/templates/spire-agent.yaml <ul><li>Changed NodeAttestor from <code>k8s_sat</code> to <code>k8s_psat</code> (projected service account tokens) <li> Added <code>tokenAudience</code> configuration for token validation <li> Added cleanup init container to remove stale agent socket <li> Added projected service account token volume mount <li> Changed node name field reference from <code>status.podIP</code> to <code>spec.nodeName</code> <li> Added <code>automountServiceAccountToken: true</code> and <code>dnsPolicy: </code> <code>ClusterFirstWithHostNet</code> <li> Updated RBAC resource names to use helper functions</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-aa04a5403011130bfa140d517882c144cd2d4c5639d0860aceff70417e13661e">+30/-5</a>    </td> </tr> <tr> <td> <details> <summary>00000000000005_device_metrics_summary_cagg_fix.up.sql<dd><code>Add device metrics CAGG rebuild migration</code>                                </dd></summary> <hr> pkg/db/cnpg/migrations/00000000000005_device_metrics_summary_cagg_fix.up.sql <ul><li>New migration file that rebuilds device metrics CAGGs for Timescale compatibility <li> Drops and recreates three single-hypertable CAGGs with proper constraints <li> Creates composite view joining the three CAGGs <li> Handles idempotent migration for clusters with version 0003</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2214c732dd7ffe7877dd9cad923ac3059754eb2b17d8bc16457a0b7b55e23c9e">+118/-0</a>  </td> </tr> </table></details></td></tr><tr><td>Configuration changes</td><td><details><summary>13 files</summary><table> <tr> <td> <details> <summary>main.go<dd><code>Update default CNPG database name</code>                                                </dd></summary> <hr> cmd/tools/cnpg-migrate/main.go - Changed default database name from "telemetry" to "serviceradar" </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-93eee0002cd036549d4ef0161788fbe4f4382eb266cc83b89517953b7448803e">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>tools-profile.sh<dd><code>Remove Proton references from Docker Compose</code>                          </dd></summary> <hr> docker/compose/tools-profile.sh <ul><li>Removed all Proton-related environment variables and aliases <li> Updated default CNPG database from "telemetry" to "serviceradar" <li> Removed Proton CLI aliases and helper functions <li> Removed Proton certificate generation and connectivity checks</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-f47597e2f5d4d085d8bf109109608f8ec0b7db8e90545e869b9ae409b607a4ac">+3/-44</a>    </td> </tr> <tr> <td> <details> <summary>generate-certs.sh<dd><code>Simplify certificate generation for non-Proton setup</code>          </dd></summary> <hr> docker/compose/generate-certs.sh <ul><li>Simplified certificate permission handling by removing Proton-specific logic <li> Removed special handling for uid 999 (Proton user) <li> Unified certificate ownership to serviceradar user</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8298241543b4744a6ac7780c760ac5b5a0a87ba62de19c8612ebe1aba0996ebd">+2/-37</a>    </td> </tr> <tr> <td> <details> <summary>entrypoint-certs.sh<dd><code>Remove Proton certificate generation</code>                                          </dd></summary> <hr> docker/compose/entrypoint-certs.sh <ul><li>Removed Proton certificate generation from certificate check condition <li> Removed generation of Proton-specific certificates <li> Removed copying of core certificates for Proton use</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-83d6800b184a5233c66c69766286b0a60fece1bc64addb112d9f8dc019437f05">+2/-10</a>    </td> </tr> <tr> <td> <details> <summary>entrypoint-srql.sh<dd><code>Update SRQL entrypoint database name</code>                                          </dd></summary> <hr> docker/compose/entrypoint-srql.sh - Updated default CNPG database from "telemetry" to "serviceradar" </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-16cf075815de9081558fd4ee53d1138c488cd8756b43259be4a82c86dac514ac">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>BUILD.bazel<dd><code>Update flowgger base image to Debian</code>                                          </dd></summary> <hr> docker/images/BUILD.bazel <ul><li>Changed flowgger image base from <code>ubuntu_noble_linux_amd64</code> to <code>debian_testing_slim_linux_amd64</code></ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-0e4db31c224a8f72ae8e870a849e38a59d74a2c7f7b04347b0b3eb07e20c5a80">+1/-72</a>    </td> </tr> <tr> <td> <details> <summary>db-event-writer.docker.json<dd><code>Update db-event-writer database configuration</code>                        </dd></summary> <hr> docker/compose/db-event-writer.docker.json <ul><li>Updated default CNPG database name from "telemetry" to "serviceradar"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9fc51271f7ef5bb460160013e24e44e829b730656891d26fc49d5fe72fbb3147">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>serviceradar-config.yaml<dd><code>Helm configuration templating and OTEL service integration</code></dd></summary> <hr> helm/serviceradar/files/serviceradar-config.yaml <ul><li>Added <code>$otelSA</code> template variable for OTEL service account configuration <li> Replaced hardcoded values with Helm template variables for <code>trustDomain</code>, <code>spireNamespace</code>, and CNPG configuration <li> Updated CNPG database defaults from <code>telemetry</code> to <code>serviceradar</code> and added CA file path templating <li> Added <code>edge_onboarding.encryption_key</code> templating and updated security configurations to use template variables <li> Reformatted entire configuration file with consistent indentation and spacing <li> Added new service configurations: <code>otel.toml</code>, <code>trapd.json</code>, <code>sync.json</code>, <code>faker.json</code>, <code>rperf.json</code>, and updated <code>datasvc.json</code> with NATS security and OTEL service account RBAC <li> Updated <code>core-k8s-init.sh</code> to support edge onboarding encryption key and CNPG CA file configuration</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-b8c8d2484103b11c396bc60d290c81df63c30a0f81103eceb5852a17e1d2b5e3">+1237/-1402</a></td> </tr> <tr> <td> <details> <summary>docker-compose.yml<dd><code>Remove Proton database service from Docker Compose</code>              </dd></summary> <hr> docker-compose.yml <ul><li>Removed entire Proton (TimeBase) database service and related containers (<code>proton</code>, <code>credentials-permissions-fixer</code>) <li> Removed Proton-related environment variables and dependencies from core service <li> Updated CNPG database name default from <code>telemetry</code> to <code>serviceradar</code> <li> Simplified core service dependencies by removing Proton health checks and credential permissions fixer</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e45e45baeda1c1e73482975a664062aa56f20c03dd9d64a827aba57775bed0d3">+1/-90</a>    </td> </tr> <tr> <td> <details> <summary>docker-compose.dev.yml<dd><code>Remove Proton service from Docker Compose</code>                                </dd></summary> <hr> docker-compose.dev.yml <ul><li>Removed entire Proton service definition including ports, volumes, environment variables, and health checks <li> Removed Proton dependency from core service <li> Updated core service comments to reference CNPG instead of Proton <li> Removed Proton-related environment variables from core</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9542f82d64bbeebd91f6236324bfe199e9657e2cb1fd9779d5d6dcdcf9cd4de1">+1/-56</a>    </td> </tr> <tr> <td> <details> <summary>values.yaml<dd><code>Update Helm values for CNPG and SPIRE configuration</code>            </dd></summary> <hr> helm/serviceradar/values.yaml <ul><li>Removed <code>proton</code> image tag from configuration <li> Updated <code>flowgger</code> image tag to <code>1.0.56</code> (fixed OpenSSL version) <li> Added comprehensive <code>cnpg</code> configuration section with host, port, database, credentials, and TLS settings <li> Added <code>agent</code> resource limits and requests configuration <li> Added <code>dbEventWriter</code> configuration with config source and KV bootstrap options <li> Added <code>tokenAudience</code> and <code>additionalAgentNamespaces</code> to SPIRE configuration <li> Added <code>otelServiceAccount</code> to SPIRE service accounts <li> Enabled SPIRE controller manager by default <li> Removed entire <code>proton</code> resource and storage configuration section <li> Added <code>secrets.autoGenerate</code> and <code>secrets.edgeOnboardingKey</code> configuration</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d4449c7cb70362554b274f81eae5a4b81a8e81df494282e383d1b7ea3871c452">+30/-13</a>  </td> </tr> <tr> <td> <details> <summary>Makefile.docker<dd><code>Remove Proton targets from Docker Makefile</code>                              </dd></summary> <hr> Makefile.docker <ul><li>Updated help text to remove Proton references <li> Removed <code>logs-proton</code> and <code>db-shell</code> make targets <li> Updated <code>up</code> target to start only core service instead of core + proton <li> Removed <code>db-query</code> and <code>docker-build-proton</code> targets <li> Updated test target to remove Proton health check <li> Updated status output to remove Proton references</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9622619b5207ed1b3ace8ccab271f0f000e5271e1d6412a5b598a3171f5f1080">+5/-23</a>    </td> </tr> <tr> <td> <details> <summary>db-event-writer.json<dd><code>Update db-event-writer config for serviceradar database</code>    </dd></summary> <hr> packaging/event-writer/config/db-event-writer.json <ul><li>Updated CNPG database name from <code>telemetry</code> to <code>serviceradar</code> <li> Updated CNPG username from <code>postgres</code> to <code>serviceradar</code></ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-cfc1471409ee6c7ecb54740385292b9cdb893cfa06e2e68cfa113f3e04b93d28">+2/-2</a>      </td> </tr> </table></details></td></tr><tr><td>Documentation</td><td><details><summary>31 files</summary><table> <tr> <td> <details> <summary>diagnostics.go<dd><code>Update diagnostics documentation terminology</code>                          </dd></summary> <hr> pkg/registry/diagnostics.go <ul><li>Updated comment to reference "database" instead of "Proton" in <code>SampleMissingDeviceIDs</code> documentation</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8953c27bc3e4d123608f6309ef64305f8ed3044f73b2c922aef4b4fbb2daca74">+3/-3</a>      </td> </tr> <tr> <td> <details> <summary>discovery.go<dd><code>Update discovery model comment terminology</code>                              </dd></summary> <hr> pkg/models/discovery.go <ul><li>Updated comment for <code>LocalIfIndex</code> field from "Proton driver" to "Postgres driver"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-4f33050bcce606cc37bbdcef6390b5a837391d7786eef0c87e3d215df5e5a811">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>time_utils.go<dd><code>Update timestamp validation comment</code>                                            </dd></summary> <hr> pkg/core/time_utils.go <ul><li>Updated comment to reference "database's supported range" instead of "Proton"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-cb35ec9be4bea563436bf57ea2570c10a2979a3040b4d2c4dc4e7ac841badb02">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>sanitize.go<dd><code>Update metadata size limit comment</code>                                              </dd></summary> <hr> pkg/deviceupdate/sanitize.go <ul><li>Updated comment to reference "CNPG row limits" instead of "Proton row limits"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e13cc657b9aa7f5581dbf7ff1edd7437065cd38900314b7cc69f6518c980145f">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>stats.go<dd><code>Update stats model documentation</code>                                                  </dd></summary> <hr> pkg/models/stats.go <ul><li>Updated comment to reference "warehouse" instead of "Proton" for device stats computation</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-b2427f93703f908f0e81defdceff494948bfae36e9c71b1c7cd135d2a4fa25f4">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>device_transform.go<dd><code>Update device transform documentation</code>                                        </dd></summary> <hr> pkg/registry/device_transform.go <ul><li>Updated comment to remove "Proton" reference in device record creation documentation</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-ece077c963daf0f46cb4cfe0e938ff22569f0d29da9376f3f78bd5bb8e586836">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>device.go<dd><code>Update device registry comment</code>                                                      </dd></summary> <hr> pkg/registry/device.go <ul><li>Updated comment to reference "CNPG store" instead of "Proton" for device hydration</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-a71b8e62531ef2608845e1f2581bb30c62fe3b77b8a98094723d5cfa0e7571a2">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>traceTimestamp.test.ts<dd><code>Update web test descriptions terminology</code>                                  </dd></summary> <hr> web/src/utils/traceTimestamp.test.ts <ul><li>Updated test descriptions from "Proton DateTime64" to "legacy DateTime64" <li> Updated test descriptions from "Proton-formatted" to "legacy formatted"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d06cfab4e92bab9894d7b1dbb9a6f5c71e80c14fdf4f1f0d616266d1443867a3">+2/-2</a>      </td> </tr> <tr> <td> <details> <summary>streaming-client.ts<dd><code>Update streaming client log message</code>                                            </dd></summary> <hr> web/src/lib/streaming-client.ts <ul><li>Updated console log message from "Proton batch completion" to "legacy batch completion" <li> Added newline at end of file</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-0ef56f7aa6d7c9dcfd75c1cce1a28e4dcd1cc78afc008386bd5918ab6f56b4ea">+2/-2</a>      </td> </tr> <tr> <td> <details> <summary>traceTimestamp.ts<dd><code>Update timestamp normalization documentation</code>                          </dd></summary> <hr> web/src/utils/traceTimestamp.ts <ul><li>Updated JSDoc comment to reference "legacy DateTime64-style values" instead of "Proton"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e8c3f7bfa0a9cc7234bf357c3d75ab62f2dc9541629305cb81603e2d6f82bc03">+1/-1</a>      </td> </tr> <tr> <td> <details> <summary>fix-cert-permissions.sh<dd><code>Update certificate permissions comment</code>                                      </dd></summary> <hr> docker/compose/fix-cert-permissions.sh <ul><li>Updated comment to reference "database containers" instead of "Proton"</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-17ea40a11edcaa7c85bb4215fda46b5a32505246fef0ab5f3ed47b28470c5ec8">+2/-2</a>      </td> </tr> <tr> <td> <details> <summary>CNCF_GTR.md<dd><code>Complete CNCF General Technical Review documentation</code>          </dd></summary> <hr> docs/LF/CNCF_GTR.md <ul><li>Updated project metadata with version 1.0.56 and website URL <li> Filled in all Day 0 planning phase sections with detailed project information <li> Completed Day 1 installation and deployment phase documentation <li> Completed Day 2 operations phase with scalability, observability, and compliance details <li> Added comprehensive security and threat modeling information <li> Documented architecture, dependencies, and troubleshooting procedures</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7ddb26818f49044184af2831a3888b09c31b034f82e1919639544a1749140bfc">+168/-90</a></td> </tr> <tr> <td> <details> <summary>ADR-02.md<dd><code>Update ADR-02 to reference CNPG instead of Proton</code>                </dd></summary> <hr> sr-architecture-and-design/adr/ADR-02.md <ul><li>Replaced all "Proton" references with "CNPG" or "CNPG/Timescale" <li> Updated architecture description to reflect CNPG as primary streaming engine <li> Updated implementation plan and consequences sections <li> Maintained all technical design details while updating terminology</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-432999051a94d8449d11f5d6a8ad9f7b5fbff1252e6a7945b393ed0b9bca40ba">+37/-37</a>  </td> </tr> <tr> <td> <details> <summary>06-snmp-discovery.md<dd><code>Update SNMP discovery PRD to reference CNPG</code>                            </dd></summary> <hr> sr-architecture-and-design/prd/06-snmp-discovery.md <ul><li>Replaced all "Proton" references with "CNPG" or "CNPG/Timescale" <li> Updated data pipeline descriptions to reference CNPG streams <li> Updated diagrams and flow descriptions <li> Maintained all functional requirements and specifications</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d28d87b97a9aa09d7e8058518d2f4ad4c9dbbd5da6d6792dda7eb1d8ae738e78">+21/-21</a>  </td> </tr> <tr> <td> <details> <summary>tls-security.md<dd><code>Remove Proton TLS configuration documentation</code>                        </dd></summary> <hr> docs/docs/tls-security.md <ul><li>Removed all Proton-specific TLS configuration sections <li> Removed Proton certificate deployment instructions <li> Removed Proton configuration examples <li> Updated certificate overview to remove Proton references <li> Removed Proton verification and troubleshooting steps <li> Simplified certificate deployment to focus on CNPG and ServiceRadar components</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-fe75bcced80b2fb5cf39bd06e6edda7de714827915abedfaf41a54802f561d22">+11/-129</a></td> </tr> <tr> <td> <details> <summary>CHANGELOG<dd><code>Add ServiceRadar v1.0.56 release notes</code>                                      </dd></summary> <hr> CHANGELOG <ul><li>Added new version entry for ServiceRadar v1.0.56 with highlights on flowgger OpenSSL fix and agent/poller stability improvements <li> Documented CNPG app bootstrap job for automatic database and user creation <li> Noted removal of init-container hack and TCP probe improvements <li> Updated resource requests/limits for agent and poller components</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-ecec88c33adb7591ee6aa88e29b62ad52ef443611cba5e0f0ecac9b5725afdba">+12/-24</a>  </td> </tr> <tr> <td> <details> <summary>DOCKER_QUICKSTART.md<dd><code>Update Docker quickstart documentation for Proton removal</code></dd></summary> <hr> DOCKER_QUICKSTART.md <ul><li>Updated quick start description to remove Proton database references <li> Removed Proton HTTP and Native port endpoints from available services list <li> Simplified service startup description to focus on core stack (CNPG, NATS, web, API) <li> Removed Proton from "What's Running?" section</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d39bb63b06e41b96069fe4f289e4d28a4f205f8e953c141e6f4d9c715bbb75b3">+2/-6</a>      </td> </tr> <tr> <td> <details> <summary>CNCF_DAY0.md<dd><code>Replace Proton database references with CNPG/Timescale</code>      </dd></summary> <hr> docs/CNCF/CNCF_DAY0.md <ul><li>Replaced all references to <code>Timeplus Proton</code> with <code>CNPG/Timescale</code> throughout the documentation <li> Updated architecture diagrams and component descriptions to reflect the new database technology <li> Removed Proton-specific configuration examples (e.g., <code>proton.resources.memory</code> Helm parameter) <li> Updated database storage and query references to use CNPG/Timescale terminology</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-49a3c958df12738f89e0f701e36d8aee08dc3e8bf275a0421159cff0c2e5a9ce">+17/-18</a>  </td> </tr> <tr> <td> <details> <summary>docker-setup.md<dd><code>Update Docker setup documentation for CNPG migration</code>          </dd></summary> <hr> docs/docs/docker-setup.md <ul><li>Removed all Proton database references and replaced with CNPG/Postgres tooling <li> Updated database maintenance section to use <code>psql</code> instead of Proton client <li> Removed Proton-specific backup/restore procedures and volume references <li> Updated troubleshooting section to use Postgres connection strings <li> Removed Proton service from Docker Compose dependency graph</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8604269dffb3ce4133e48cab374ca8e97745d0efbdef67cad792aeb5945fe5ec">+17/-65</a>  </td> </tr> <tr> <td> <details> <summary>project.md<dd><code>Update project context documentation for CNPG</code>                        </dd></summary> <hr> openspec/project.md <ul><li>Replaced <code>Timeplus Proton</code> references with <code>CNPG/Timescale</code> throughout project context <li> Updated tech stack description to reflect Postgres hypertables instead of Proton streams <li> Updated data layer and analytics descriptions to use CNPG terminology <li> Changed external dependencies section to reference CNPG/TimescaleDB</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-10c431237ea8388147f27e3a0750ece7b3be53ca35a986acf49b6565508e012e">+7/-7</a>      </td> </tr> <tr> <td> <details> <summary>docker-setup.md<dd><code>Remove Proton references from Docker setup</code>                              </dd></summary> <hr> docs/docs/docker-setup.md <ul><li>Removed Proton service configuration and health checks <li> Updated configuration references from Proton to CNPG <li> Removed Proton-specific ports and volume definitions <li> Updated performance tuning section to reference CNPG instead of Proton</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8604269dffb3ce4133e48cab374ca8e97745d0efbdef67cad792aeb5945fe5ec">+17/-65</a>  </td> </tr> <tr> <td> <details> <summary>04-device-mgmt.md<dd><code>Update device management PRD for CNPG database</code>                      </dd></summary> <hr> sr-architecture-and-design/prd/04-device-mgmt.md <ul><li>Replaced all <code>Proton</code> database references with <code>CNPG</code> <li> Updated data pipeline descriptions to reference CNPG streams instead of Proton streams <li> Changed materialized view and deduplication strategy descriptions to use CNPG terminology <li> Updated phase descriptions to reference CNPG stream processing</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8a5167ec22c8d784f2a828cebf660ca971f787f6ac0211659390ba4be60ae6a7">+9/-9</a>      </td> </tr> <tr> <td> <details> <summary>agents.md<dd><code>Update agents documentation for CNPG database naming</code>          </dd></summary> <hr> docs/docs/agents.md <ul><li>Updated CNPG migration documentation to reference <code>serviceradar</code> database instead of <code>telemetry</code> <li> Updated connection examples and environment variable documentation <li> Changed database extension setup instructions to use <code>serviceradar</code> database <li> Updated all references from Proton to CNPG/Timescale</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-af8d04277f2353629065b0cc5fad3e44bd3e7c20339bd125e0812104bdbeff28">+11/-11</a>  </td> </tr> <tr> <td> <details> <summary>CNCF_security_self_assessment.md<dd><code>Update security assessment for CNPG migration</code>                        </dd></summary> <hr> docs/CNCF/CNCF_security_self_assessment.md <ul><li>Removed <code>serviceradar-proton</code> from actors list <li> Updated <code>db-event-writer</code> description to reference CNPG database instead of Proton <li> Updated <code>serviceradar-rperf-checker</code> to reference CNPG database <li> Updated <code>serviceradar-tools</code> description to reference CNPG instead of Proton <li> Updated security controls section to reference CNPG instead of Proton</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d64ffa4a0d2f25cc11d0731c714caa8b406a11b20bf63396fdb3144471e58105">+4/-5</a>      </td> </tr> <tr> <td> <details> <summary>07-cdp-discovery.md<dd><code>Update CDP discovery PRD for CNPG database</code>                              </dd></summary> <hr> sr-architecture-and-design/prd/07-cdp-discovery.md <ul><li>Replaced all <code>Proton</code> stream references with <code>CNPG</code> stream references <li> Updated data output and storage section heading from Proton to CNPG <li> Updated architecture diagrams to reference CNPG/Timescale instead of Timeplus Proton <li> Updated data models section heading to reference CNPG</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d7e7f6a736f9e66939c0f0eec61fe5e753aeec16c90f11957867aee09bbfdf1c">+10/-10</a>  </td> </tr> <tr> <td> <details> <summary>09-bgp-discovery.md<dd><code>Update BGP discovery PRD for CNPG database</code>                              </dd></summary> <hr> sr-architecture-and-design/prd/09-bgp-discovery.md <ul><li>Replaced all <code>Proton</code> stream references with <code>CNPG</code> stream references <li> Updated data output and storage section heading from Proton to CNPG <li> Updated architecture diagrams to reference CNPG/Timescale instead of Timeplus Proton <li> Updated data models section heading to reference CNPG</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-88a31bb8e1ae1b27d3252978f9c41e90e5d9bff051086bc683b4cfed42836edb">+10/-10</a>  </td> </tr> <tr> <td> <details> <summary>08-lldp-discovery.md<dd><code>Update LLDP discovery PRD for CNPG database</code>                            </dd></summary> <hr> sr-architecture-and-design/prd/08-lldp-discovery.md <ul><li>Replaced all <code>Proton</code> stream references with <code>CNPG</code> stream references <li> Updated data output and storage section heading from Proton to CNPG <li> Updated architecture diagrams to reference CNPG/Timescale instead of Timeplus Proton <li> Updated data models section heading to reference CNPG</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c86660f2bdf013d7253e5458cd65b72ed44d5af6d02a6e37f3a4a97390f13c35">+10/-10</a>  </td> </tr> <tr> <td> <details> <summary>README.md<dd><code>Update Docker README for CNPG migration</code>                                    </dd></summary> <hr> docker/README.md <ul><li>Removed all Proton database references and configuration details <li> Updated component descriptions to remove Proton <li> Removed Proton-specific security and health check sections <li> Updated configuration file references from Proton to CNPG <li> Removed Proton ports and volume definitions <li> Updated troubleshooting section to use Postgres connection strings <li> Removed Proton-specific development commands</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-da8fcbe728a9172b578e5d754f8e2df214c658c4321f610e63dd68bea828ab49">+10/-36</a>  </td> </tr> <tr> <td> <details> <summary>tasks.md<dd><code>Add Helm demo chart update tasks documentation</code>                      </dd></summary> <hr> openspec/changes/update-helm-demo-chart/tasks.md <ul><li>New file documenting implementation tasks for Helm demo chart updates <li> Lists completed tasks for CNPG migration, SPIRE alignment, and secret generation <li> Documents validation steps and recent fixes for db-event-writer and SPIFFE <li> Includes notes on current blockers and TODO items for app database bootstrap</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-dc4ce7d98542ec59ca906b1846d66336a810696d3a6aa3a5c0f9da4672481e11">+41/-0</a>    </td> </tr> <tr> <td> <details> <summary>agents.md<dd><code>Update agents documentation for CNPG database</code>                        </dd></summary> <hr> docs/docs/agents.md <ul><li>Updated database name references from <code>telemetry</code> to <code>serviceradar</code> <li> Updated CNPG migration documentation and examples <li> Updated extension setup instructions for serviceradar database <li> Updated all Proton references to CNPG/Timescale</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-af8d04277f2353629065b0cc5fad3e44bd3e7c20339bd125e0812104bdbeff28">+11/-11</a>  </td> </tr> <tr> <td> <details> <summary>AGENTS.md<dd><code>Update AGENTS.md for CNPG migration</code>                                            </dd></summary> <hr> AGENTS.md <ul><li>Replaced <code>Proton/Timeplus</code> with <code>CNPG/Timescale</code> in project overview <li> Updated repository layout description to reference CNPG instead of Proton <li> Updated operational runbooks reference to use CNPG terminology <li> Removed Proton SQL helper command example</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-a54ff182c7e8acf56acfd6e4b9c3ff41e2c41a31c9b211b2deb9df75d9a478f9">+3/-11</a>    </td> </tr> </table></details></td></tr><tr><td>Bug fix</td><td><details><summary>1 files</summary><table> <tr> <td> <details> <summary>events.go<dd><code>Fix event upsert conflict resolution</code>                                          </dd></summary> <hr> pkg/db/events.go <ul><li>Modified <code>ON CONFLICT</code> clause to include both <code>id</code> and <code>event_timestamp</code> columns <li> Ensures proper conflict resolution for event upserts</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-bf1824600585d423d03392632872269bf1d5f976430b55d7a9bd1238bc8de6b5">+1/-1</a>      </td> </tr> </table></details></td></tr><tr><td>Tests</td><td><details><summary>1 files</summary><table> <tr> <td> <details> <summary>tests.rs<dd><code>Add packaging rules validation test</code>                                            </dd></summary> <hr> cmd/consumers/zen/src/tests.rs <ul><li>Added new test <code>packaging_rules_parse</code> to validate all packaging rules JSON files <li> Ensures all rule files in packaging directory parse correctly</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-85c5601521c9a9784723e5882651a72b3828419842d17046e71c65330bb95419">+27/-0</a>    </td> </tr> </table></details></td></tr><tr><td>Formatting</td><td><details><summary>1 files</summary><table> <tr> <td> <details> <summary>build.rs<dd><code>Improve build script error handling</code>                                            </dd></summary> <hr> cmd/checkers/rperf-client/build.rs <ul><li>Improved error handling formatting for <code>RUNFILES_DIR</code> environment variable check <li> Better code readability with multi-line error construction</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-251e7a923f45f8f903e510d10f183366bda06d281c8ecc3669e1858256e2186d">+6/-1</a>      </td> </tr> </table></details></td></tr><tr><td>Dependencies</td><td><details><summary>1 files</summary><table> <tr> <td> <details> <summary>MODULE.bazel<dd><code>Update Bazel module dependencies for CNPG migration</code>            </dd></summary> <hr> MODULE.bazel <ul><li>Added <code>debian_testing_slim</code> OCI image pull for Debian testing base <li> Removed <code>timeplus_proton</code> OCI image pull and related configuration <li> Reordered <code>http_archive</code> attributes for <code>cmake_linux_amd64_prebuilt</code> for consistency</ul> </details> </td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-6136fc12446089c3db7360e923203dd114b6a1466252e71667c6791c20fe6bdc">+15/-28</a>  </td> </tr> </table></details></td></tr><tr><td>Additional files</td><td><details><summary>101 files</summary><table> <tr> <td>sbom-syft.yml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-f79636c7ac6e657fd98f9ead92fd4ffe68b8306a9a329bb602e3d1520b8a8017">+36/-0</a>    </td> </tr> <tr> <td>Cargo.toml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2e9d962a08321605940b5a657135052fbcef87b5e360662bb527c96d9a615542">+0/-1</a>      </td> </tr> <tr> <td>ROADMAP.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-683343bdf93f55ed3cada86151abb8051282e1936e58d4e0a04beca95dff6e51">+2/-2</a>      </td> </tr> <tr> <td>VERSION</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7b60b8e351cbb80c47459ffe2c79f1a26404871f49294780fe47ad0e58c09350">+1/-1</a>      </td> </tr> <tr> <td>Dockerfile</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9f8119755792e77da338d2d29ce5e1bbfeeb8f5816a3233e78a9e206bafb0b53">+1/-3</a>      </td> </tr> <tr> <td>config.json</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2423ef78d36e905ae993b69ff59f5df6b2e1b9492fb0fa8c6d0aad7c76d2d229">+4/-4</a>      </td> </tr> <tr> <td>config.json</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-ef778d85ac6f9652c25cb0d631f0fe8dfb3edac4dde5d719a4fc2926fb5c3216">+4/-4</a>      </td> </tr> <tr> <td>Dockerfile</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-62c9619630b9f9c73e89622525098ec4722282a8499ef89df09116d0840566ae">+1/-3</a>      </td> </tr> <tr> <td>BUILD.bazel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-cb01221a679138b516a4aeb6430059766608ff76866889984afc4e5966d4c0cd">+0/-27</a>    </td> </tr> <tr> <td>Cargo.toml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7e81a80667bc70c00bdbf54a8830fb9ecd7e73bf0f16979107e6df36205125f4">+0/-28</a>    </td> </tr> <tr> <td>README.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e06d0e19bede4195d7f754cb01ae014b487875974ae58c62e064d0d51e6f3281">+0/-183</a>  </td> </tr> <tr> <td>build.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-660177a66a475c1af352388464e4dcf4fab913c3411b6f1315322dba0013c220">+0/-34</a>    </td> </tr> <tr> <td>poller-ng.json</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c4b6df57ffb7936ec1222358297da59267d70045618a8d0ac4c20542bf1a62eb">+0/-61</a>    </td> </tr> <tr> <td>adapter.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-80ea8a2e03ec54b66babde1b4e8e6e07ab0f4550a71c715260eac4392c3c3f38">+0/-640</a>  </td> </tr> <tr> <td>main.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-f6d1216ef2bdbded76dcfbfed0ebb1f07ce21c27d56f609168cc0bb55fe7bc1d">+0/-165</a>  </td> </tr> <tr> <td>mod.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-3696a6db231e9d81fc6f9df66758504d7c1f5cbe11c2e32805c8017c98e5089a">+0/-20</a>    </td> </tr> <tr> <td>types.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-19d813700210df89bd4db1c31dee0aec8de9131dc40f49b52c4bd9865a59e618">+0/-101</a>  </td> </tr> <tr> <td>processor.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-f4cd8762c1866978ea1c2271c4f7f1343434d67eb487c96d75bafe1c88dca803">+0/-68</a>    </td> </tr> <tr> <td>mod.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1c3183d9972270ced5bcb737070a8548f63b7be36280adf94ea055d2c94e1925">+0/-21</a>    </td> </tr> <tr> <td>rperf.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-31c6206b75a08b14a7d5a04fcbd878b2a70fa2ec949500d76f011869869e19b9">+0/-121</a>  </td> </tr> <tr> <td>snmp.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1f305b307843be26316104fdf5dcb26dc4b8bd7a1289d7bd3d545fac9d061035">[link]</a>    </td> </tr> <tr> <td>sysmon.rs</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-fa0ff2891411b4ebd350bb32e01a931868937ae7329d07226101d89b624bd8e3">+0/-190</a>  </td> </tr> <tr> <td>BUILD.bazel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c9735be1a6d0bb80642f46e33d7b3bf672d90c9ab654bd8c4bc6272039b66eff">+0/-35</a>    </td> </tr> <tr> <td>monitoring.proto</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-483df2a75525ebb30bd83e57107853abee1f1da1906c48f104e447f1f303522b">+0/-79</a>    </td> </tr> <tr> <td>Dockerfile</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7ee3f454058c8cf12947948e4f4f302e7a461b9d79bb447c15e68f4b02668647">+1/-3</a>      </td> </tr> <tr> <td>docker-compose.override.yml.example</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-4098b35b2a4e2adb1c5b73eeed72952144a75f7a97817348691f3d5447ed39df">+2/-2</a>      </td> </tr> <tr> <td>LOCAL_BUILD.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-948f9df9c7f0c9bf1fdbce3c5baa338d5de727954eb78c4aa7333ea333e03ff0">+1/-3</a>      </td> </tr> <tr> <td>BUILD.bazel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-046caf5cc3d6fd4c553c077414d7a2514b61c45fb35bb1826c202a92f99d5962">+0/-22</a>    </td> </tr> <tr> <td>Dockerfile.flowgger</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-69f79715bb0b14a73648bb316104767b9c1274e70c2ab277537cfd96556e31e9">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.otel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-27be12c60b17030a7ed1c25d14179527031ffb4440b1abee3a3924de2a1dcc2c">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.proton</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-5e391d1f7f77325c0736729631cd99f2122ff5bce8962e992bd78e940ecfe458">+0/-99</a>    </td> </tr> <tr> <td>Dockerfile.tools</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-0258db71e4070e342198965f1d046f3097640850b037df8a2287a7e239630add">+1/-3</a>      </td> </tr> <tr> <td>Dockerfile.trapd</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8dced88e843a6c8dc444f104f759b9908a0c98c8843ae0da2f92f498920f541c">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.zen.optimized</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e51c4ee786da96bd12f07a092053b71ffa235516747be7443f04826df012abff">+3/-5</a>      </td> </tr> <tr> <td>entrypoint-core.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8338c1aca698162657e6ec96bfa568dd1f27250c7939107c927c11685db1e051">+0/-40</a>    </td> </tr> <tr> <td>fix-credentials-permissions.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8b5ae66cce5d7cffa4f22c78a8512ef1526793cad77599f86eb4a44883cc9ce0">+0/-38</a>    </td> </tr> <tr> <td>proton-cli.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-519a1cfb1036771f1a3af37d8966f1cf75c385bb92123ead3d1c186392cbcc2c">+0/-2</a>      </td> </tr> <tr> <td>proton-client-config.xml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d1919196349b9c28341217edc6985ea07c7f1e1fdbd9ea1e11f9ef8290290fe0">+0/-18</a>    </td> </tr> <tr> <td>proton-client.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c2829eaa240aa00189646b51a15ab31671141b895ebddb1af4189e839b47959c">+0/-76</a>    </td> </tr> <tr> <td>proton-info.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-02c3e03b6164d473fccdd163986299bdc7568d1b9a49a988c5fed84b00bde6b7">+0/-33</a>    </td> </tr> <tr> <td>proton-init.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9f0e9459b12fc8cb2671d78218467129cbb18b110443a0799c7559cf7ba19d4e">+0/-167</a>  </td> </tr> <tr> <td>proton-limits.conf</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-5e952db472aa3d84e78f31de2c6d874d13984354fab6b83bc263c1a22d6be879">+0/-4</a>      </td> </tr> <tr> <td>proton-openssl.xml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-5740a7c1ff35d37b391655cf92917c98b16d084120142c899007eec0179c6f04">+0/-9</a>      </td> </tr> <tr> <td>proton-sql.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e4aff2a86de8bcc3684de934da8e0105e20771f537b5e09ba1e69a57c2f74842">+0/-12</a>    </td> </tr> <tr> <td>proton-sysctl.conf</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7d3619cd063a6b212105bd085bbf5719c7aad440676a29c0746ba8f758c6e995">+0/-3</a>      </td> </tr> <tr> <td>proton-wrapper.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-4d34d8d830d98a93a3f025d5c2de42de2f73569652b7c83fdd369064a4d6d508">+0/-46</a>    </td> </tr> <tr> <td>tools-motd.txt</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-b66b550fcd1772acb59e343e845225193c6b9601e78a29a1f124b7bcd9ca636a">+1/-12</a>    </td> </tr> <tr> <td>push_targets.bzl</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-4af33fe62caba04b6d479589c16cfb85babc39bae5c92595d4d4e31660738513">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.rpm.proton</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-46c394d0d6b38be50e9c5ebd2cf8eb5afc5e3dc5efcbf4245b21a091e8c02999">+0/-82</a>    </td> </tr> <tr> <td>Dockerfile.rpm.rust.flowgger</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-6ae2da8fc631ae1a5b25905220b538bf5171e75564f8abc8843ae0b4a016a14a">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.rpm.rust.otel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2d5275859ce5d9b90a0280262d8a80961fe1be77bb6db987718fad887f6b2e85">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.rpm.rust.trapd</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-9001d83d2922782b604c6fbd2da032a0ad9ee9cd145dff79cd0b25e98c7e6a5d">+0/-1</a>      </td> </tr> <tr> <td>Dockerfile.rpm.rust.zen</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-031b60e6fee3fa0b55923249aa401a578d2ab0be91bb1c2f8c16293ea1e1b493">+0/-1</a>      </td> </tr> <tr> <td>CNCF_Pre_check.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-b38f455c8a9bf88237660d0d0bfb0be08363dc396b61a4beaa933d2c49b7a8b2">+2/-7</a>      </td> </tr> <tr> <td>LF_Github_Recommendations.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-08b05bf3c7d94f2dc9083a13e58ab990f4504cd1837679a383a856bd2c6c76d9">+10/-9</a>    </td> </tr> <tr> <td>LF_SECURITY_CHECK.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-a9b52b548843ee309660cf6c4a6c6f7e95cc1dae2f19f0f3943f482c64d59308">+10/-8</a>    </td> </tr> <tr> <td>SBOM.spdx</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-cc7f2cb66c3c2b69bead04abd2a5f923b9e618fc4aa952aa63a9f72df4c9650e">+1/-167669</a></td> </tr> <tr> <td>repo_lint.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-dfe29a772e511687dd2d217459b7017d8372833553adb5b897130db616d9ba73">+38942/-3</a></td> </tr> <tr> <td>third-party-deps.html</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-64d5d5fa69723d0cad8203eca9df970f041814ba30a57f49d62e7e06c5cb37c2">[link]</a>    </td> </tr> <tr> <td>armis.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-3e5c728550851ae1cfb8754eb8a1566d8084ebc58646c73f7c29ac6f7d60adbf">+1/-1</a>      </td> </tr> <tr> <td>cnpg-monitoring.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8c105f73fd3323743d06525e84c5d0c686b447742dca1a5cf2776b1afc9b8ba2">+1/-1</a>      </td> </tr> <tr> <td>discovery.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-a7f02a003a0e9aaf09d6aa072689ca8ad8b7b298ee014c6ffb878d2a5ecbab28">+3/-3</a>      </td> </tr> <tr> <td>edge-agent-onboarding.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-de3e3c427ab9d2de35912ffd2f87d2b2074ca09aade4deade726e0627d9a5af4">+3/-3</a>      </td> </tr> <tr> <td>netflow.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-a64260e87bce20ed3bd93c7b64dac6ff175cdc7c67071276601aa9f6d370d634">+3/-3</a>      </td> </tr> <tr> <td>otel.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-498eac46d1b44ca23346a9ef5edc4f38030fe37ce7313e691a0644e9deb381f4">+2/-2</a>      </td> </tr> <tr> <td>proton.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-b0b59eebab93d94bc36bed9d49acc619ae2725d1fd4594a2ea0173dee9aa0136">+0/-318</a>  </td> </tr> <tr> <td>search-planner-operations.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-603215d70bf28587f606811c0cc257dadec37a130a8e4fe95a4664c52727ddca">+1/-1</a>      </td> </tr> <tr> <td>service-registry-design.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-eeff62de7c13c07e98f187ab6b5173585e47ab26969ddae687e69783483116fa">+1/-1</a>      </td> </tr> <tr> <td>service-registry-status.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-14b25655121cc9d193e18e37912ff77cc784ac513d53ec8240b45d440bd72575">+3/-3</a>      </td> </tr> <tr> <td>srql-language-reference.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7fa04d96755318e393180aaae41cb1374c1da332b3fca76c29e443fd7146ef5f">+1/-1</a>      </td> </tr> <tr> <td>troubleshooting-guide.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-343b87dd0b430b3f99b16d32200c353bb6e3d7bbb185da3c1b3effc3a03e7f2a">+2/-2</a>      </td> </tr> <tr> <td>querying-service-config.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-d3137a2f64773d946c5cab90c8d7a2e6e3a41c983654a1651b77c3e43c43f1c5">+2/-2</a>      </td> </tr> <tr> <td>sidebars.ts</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-6e908f6e4016ad389cfb93ce7a47df677247c0f9d17c3589710592e8cf9527e0">+0/-1</a>      </td> </tr> <tr> <td>README.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c8e7e7621289da2f10b4ffd1c0ca4fd7321a19a4f18d01cc84b5fd3d06dea105">+6/-32</a>    </td> </tr> <tr> <td>generate-certs.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-224edb1896351749211a2a609692daa31f4f45cf175658124613b9dc08496d96">+0/-1</a>      </td> </tr> <tr> <td>agent.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7442a08dbf73cd750874e97ac18538aa54da15ce7e47c27d0d65fe2cc8f356ad">+8/-4</a>      </td> </tr> <tr> <td>datasvc.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-5926357bf2f08469fae4974912c952846b55e45b3edee456455b0c403c3909af">+10/-0</a>    </td> </tr> <tr> <td>db-event-writer-config.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-4cce0ab31bec3428ffae6701d20ca14b0f27a1e8a810ba1c7388e5c7860c3254">+6/-4</a>      </td> </tr> <tr> <td>db-event-writer-kv-bootstrap-job.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e04c34f80af7b258d28aa42ec4b2915d3178cc328976e9802fbcdd98a4966b7f">+57/-0</a>    </td> </tr> <tr> <td>flowgger.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-511cfbfe42e0c41cd2fddf67a04911b48724ca9ea9f6d1ddc1f4bb7bf07086ab">+4/-4</a>      </td> </tr> <tr> <td>nats.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-8d37833e102f255997d6b0cbc1e0eaaf488abc93d51e0b62323b9a7e46018688">+7/-5</a>      </td> </tr> <tr> <td>otel.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-3422f8a7811e511a91937331e4a2795bbcae8846c19ae8f7f66d52a241ad300c">+6/-0</a>      </td> </tr> <tr> <td>poller.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-609bbfe0a4f55ec766b1f55fa45382531724d3bfb781463782a2c3c8b24fd443">+13/-12</a>  </td> </tr> <tr> <td>proton.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-bf601791f2bf8f1395df12497f4de596569e7ca08dc573deb041acdc5cade97a">+0/-136</a>  </td> </tr> <tr> <td>spire-clusterspiffeids.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1b904f1e0a25142a5c87b9c3ef3970a1ea341b1abe52d74c5b13957da389c554">+3/-2</a>      </td> </tr> <tr> <td>spire-controller-manager-rbac.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-0b0704f6c235a24fee52b22e1c0d7bad0144c8b2d25e6bd7586e5e30e74a11a2">+3/-3</a>      </td> </tr> <tr> <td>spire-postgres.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1ca173bb2b8cb20ea64a4f1901850a229c0c9f40286f074e00b3301be99299bd">+25/-2</a>    </td> </tr> <tr> <td>configmap.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-f4548beaa0a3a01a46971c82c5647a0f3f49eb38d66dd939d06d19018173fcd6">+1/-1</a>      </td> </tr> <tr> <td>serviceradar-tools.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-89330d07cf9cc5953c8f6a96c9698450d59baceeeff2aa265b0e92c1b3c21852">+1/-1</a>      </td> </tr> <tr> <td>proposal.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-1cf333d533c1bd10c148d2f68db5fc8969de7f3a543035583477a73aa16174e9">+20/-0</a>    </td> </tr> <tr> <td>spec.md</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-7482a2a0ab3fcadcd12e62788410e8458c068b97a0e659ddea0870e6a6dea093">+33/-0</a>    </td> </tr> <tr> <td>core.docker.json</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-e8daaf647c9f7582595681307b2d56a0b0436bebb8e9112d9c894cacb3347a1f">+23/-23</a>  </td> </tr> <tr> <td>core.json</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-4f0af07024cb3f3d96091e6fba8a2c28a8c77e25a3cf459b89baf16b82e96723">+4/-4</a>      </td> </tr> <tr> <td>BUILD.bazel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-c70ede39e0625f97495046136ec598e94965e8ba8b4d14d81c1724f38201c79c">+0/-1</a>      </td> </tr> <tr> <td>BUILD.bazel</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-135490d390808cf8f71b7471c32647fed77a4c5862620c05b569b1f1cdbe55b1">+0/-7</a>      </td> </tr> <tr> <td>config.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-457b4de30f735ca58a681ea2207984e42d2cd9bbbf1b34d7e4840dbbd299a5fe">+0/-630</a>  </td> </tr> <tr> <td>grok-patterns</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-f89e9177480f767aaabd3828d28e8d2d04a0f9186e3306b3849e7cdd4f547ac8">+0/-94</a>    </td> </tr> <tr> <td>users.yaml</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-32824be2fa438a36e361e4a8dd2a56af61499915c233803cc65fba61ab726d89">+0/-161</a>  </td> </tr> <tr> <td>package.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-128c8cac668bb25e12f78f3edb9ab6ccaa9069452e2402f97db3a9a50aa7bc88">+0/-194</a>  </td> </tr> <tr> <td>postinstall.sh</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-5521f1f61dd62b42bc9ebc8834945805ed6c63ec6672b10bc4b9b42e9ae295e0">+0/-256</a>  </td> </tr> <tr> <td>Additional files not shown</td> <td><a href="https://github.com/carverauto/serviceradar/pull/1975/files#diff-2f328e4cd8dbe3ad193e49d92bcf045f47a6b72b1e9487d366f6b8288589b4ca"></a></td> </tr> </table></details></td></tr></tr></tbody></table> </details> ___

gitguardian[bot] commented

2025-11-22 07:32:17 +00:00

(Migrated from github.com)

Author

Owner

Imported GitHub PR comment.

Original author: @gitguardian[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1975#issuecomment-3565938987
Original created: 2025-11-22T07:32:17Z

️✅ There are no secrets present in this pull request anymore.

If these secrets were true positive and are still valid, we highly recommend you to revoke them.
While these secrets were previously flagged, we no longer have a reference to the
specific commits where they were detected. Once a secret has been leaked into a git
repository, you should consider it compromised, even if it was deleted immediately.
Find here more information about risks.

^{_{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}}

Imported GitHub PR comment. Original author: @gitguardian[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1975#issuecomment-3565938987 Original created: 2025-11-22T07:32:17Z --- #### ️✅ There are no secrets present in this pull request anymore. If these secrets were true positive and are still valid, we highly recommend you to revoke them. While these secrets were previously flagged, we no longer have a reference to the specific commits where they were detected. Once a secret has been leaked into a git repository, you should consider it compromised, even if it was deleted immediately. Find [here](https://docs.gitguardian.com/platform/remediate/remediate-incidents) more information about risks. --- 🦉 [GitGuardian](https://dashboard.gitguardian.com/auth/login/?utm_medium=checkruns&utm_source=github&utm_campaign=cr1) detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

qodo-code-review[bot] commented

2025-11-22 07:34:41 +00:00

(Migrated from github.com)

Author

Owner

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1975#issuecomment-3565943498
Original created: 2025-11-22T07:34:41Z

PR Compliance Guide 🔍

Below is a summary of compliance checks for this PR:

Security Compliance
🔴	Private key overexposure Description: Script sets 644 permissions on all certificate and private key files (including "-key.pem"), making private keys world-readable within the container filesystem, which can expose sensitive keys to non-privileged processes/users. fix-cert-permissions.sh [7-16]* Referred Code chmod 644 /etc/serviceradar/certs/.pem chmod 644 /etc/serviceradar/certs/-key.pem # Make private keys readable by owner and group # Make certificates readable by group (for database containers that run as uid=999, gid=999) chgrp -R 1000 /etc/serviceradar/certs/ chmod 755 /etc/serviceradar/certs/ chmod 644 /etc/serviceradar/certs/.pem chmod 644 /etc/serviceradar/certs/-key.pem # Make private keys readable by all for container use echo "✅ Certificate permissions fixed for ServiceRadar components (1000:1000)"
⚪	Unbounded retry loop Description: SPIFFE TLS retry/backoff loop in `load_spiffe_tls` retries indefinitely on transport/availability errors without a max retry count or overall timeout, which could cause unbounded hangs or resource retention when the Workload API is permanently unavailable. lib.rs [246-265] Referred Code fn should_retry_grpc(err: &GrpcClientError) -> bool { matches!( err, GrpcClientError::Grpc(_) \| GrpcClientError::Transport(_) ) } fn is_retryable_source_error(err: &X509SourceError) -> bool { matches!(err, X509SourceError::NoSuitableSvid) } fn is_retryable_tls_error(err: &anyhow::Error) -> bool { let msg = err.to_string(); msg.contains("no default X.509 SVID") \|\| msg.contains("failed to fetch default X.509 SVID") \|\| msg.contains("no X.509 bundle available") \|\| msg.contains("failed to fetch X.509 bundle") } // Deep-merge JSON overlay into a Serialize/Deserialize config object.
	Unbounded retry loop Description: The SPIFFE credential loading loop retries forever with fixed 2s delay and no global timeout or cap, risking indefinite startup hang and denial of service if the Workload API never becomes available. spiffe.rs [26-88] Referred Code loop { let client = match WorkloadApiClient::new_from_path(workload_socket).await { Ok(client) => client, Err(err) => { let mapped = map_grpc_error("connect to SPIFFE Workload API", workload_socket, err); warn!("{mapped}; retrying in {}s", retry_delay.as_secs()); sleep(retry_delay).await; continue; } }; let source = match X509SourceBuilder::new().with_client(client).build().await { Ok(source) => source, Err(X509SourceError::GrpcError(grpc_err)) => { if should_retry_grpc(&grpc_err) { warn!( "SPIFFE Workload API unavailable ({grpc_err:?}); retrying in {}s", retry_delay.as_secs() ); sleep(retry_delay).await; continue; ... (clipped 42 lines)
	Env secret handling Description: CNPG password is sourced from the environment and stored back into the in-memory config without masking; while common, this increases risk of accidental exposure via logs or memory dumps—ensure no logging of full config occurs and prefer file/secret mounts. main.go [67-73] Referred Code `// If the password is omitted from file config to keep it out of KV, pull it from the secret env. if cfg.CNPG != nil && cfg.CNPG.Password == "" { if pwd := os.Getenv("CNPG_PASSWORD"); pwd != "" { cfg.CNPG.Password = pwd } }`
Ticket Compliance
⚪	🎫 No ticket provided Create ticket/issue
Codebase Duplication Compliance
⚪	Codebase context is not defined Follow the guide to enable codebase context checks.
Custom Compliance
🟢	Generic: Meaningful Naming and Self-Documenting Code Objective: Ensure all identifiers clearly express their purpose and intent, making code self-documenting Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Robust Error Handling and Edge Case Management Objective: Ensure comprehensive error handling that provides meaningful context and graceful degradation Status: Passed Learn more about managing compliance generic rules or creating your own custom rules
⚪	Generic: Comprehensive Audit Trails Objective: To create a detailed and reliable record of critical system actions for security analysis and compliance. Status: Audit context: Error paths and rule-skip decisions are logged minimally without user/device identifiers or request correlation, which may limit auditability of critical rule evaluation outcomes. Referred Code let resp = match engine.evaluate(&dkey, context.clone().into()).await { Ok(r) => r, Err(e) => { if matches!( e.as_ref(), zen_engine::EvaluationError::LoaderError(le) if matches!(le.as_ref(), zen_engine::loader::LoaderError::NotFound(_)) ) { debug!("rule {dkey} not found, skipping"); continue; } let message = match e.as_ref() { zen_engine::EvaluationError::LoaderError(le) => { format!("failed to load rule {dkey}: {le}") } _ => format!("failed to evaluate rule {dkey}"), }; return Err(anyhow::Error::new(e).context(message)); } Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Error Handling Objective: To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. Status: Error detail: Returned errors wrap underlying evaluation errors which may include internal rule loader details; confirm these are not surfaced to end users or insecure logs. Referred Code `let message = match e.as_ref() { zen_engine::EvaluationError::LoaderError(le) => { format!("failed to load rule {dkey}: {le}") } _ => format!("failed to evaluate rule {dkey}"), }; return Err(anyhow::Error::new(e).context(message)); }` Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Secure Logging Practices Objective: To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. Status: Console logging: Added console logs on WebSocket close events may leak operational context in browser consoles; verify no sensitive data is included and that logging level is appropriate for production. Referred Code `this.websocket.onclose = (event) => { // Provide context-aware logging for WebSocket closures if (event.code === 1006 && this.completionReceived) { console.log('✅ [StreamingClient] WebSocket closed normally after server completion (1006 is expected for legacy batch completion)'); } else if (event.code === 1000) {` Learn more about managing compliance generic rules or creating your own custom rules
	Generic: Security-First Input Validation and Data Handling Objective: Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities Status: Secret handling: The process reads CNPG password from environment and injects into config; confirm it is not logged or exposed elsewhere and that downstream components avoid printing it. Referred Code `// If the password is omitted from file config to keep it out of KV, pull it from the secret env. if cfg.CNPG != nil && cfg.CNPG.Password == "" { if pwd := os.Getenv("CNPG_PASSWORD"); pwd != "" { cfg.CNPG.Password = pwd } }` Learn more about managing compliance generic rules or creating your own custom rules
Update

Compliance status legend

🟢 - Fully Compliant
🟡 - Partial Compliant
🔴 - Not Compliant
⚪ - Requires Further Human Verification
🏷️ - Compliance label

Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1975#issuecomment-3565943498 Original created: 2025-11-22T07:34:41Z --- ## PR Compliance Guide 🔍  Below is a summary of compliance checks for this PR: <table><tbody><tr><td colspan='2'>Security Compliance</td></tr> <tr><td rowspan=1>🔴</td> <td><details><summary>Private key overexposure </summary> Description: Script sets 644 permissions on all certificate and private key files (including "*-key.pem"), making private keys world-readable within the container filesystem, which can expose sensitive keys to non-privileged processes/users. <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-17ea40a11edcaa7c85bb4215fda46b5a32505246fef0ab5f3ed47b28470c5ec8R7-R16'>fix-cert-permissions.sh [7-16]</a> <details open><summary>Referred Code</summary> ```shell chmod 644 /etc/serviceradar/certs/*.pem chmod 644 /etc/serviceradar/certs/*-key.pem # Make private keys readable by owner and group # Make certificates readable by group (for database containers that run as uid=999, gid=999) chgrp -R 1000 /etc/serviceradar/certs/ chmod 755 /etc/serviceradar/certs/ chmod 644 /etc/serviceradar/certs/*.pem chmod 644 /etc/serviceradar/certs/*-key.pem # Make private keys readable by all for container use echo "✅ Certificate permissions fixed for ServiceRadar components (1000:1000)" ``` </details></details></td></tr> <tr><td rowspan=3>⚪</td> <td><details><summary>Unbounded retry loop </summary> Description: SPIFFE TLS retry/backoff loop in <code>load_spiffe_tls</code> retries indefinitely on transport/availability errors without a max retry count or overall timeout, which could cause unbounded hangs or resource retention when the Workload API is permanently unavailable. <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-91f4558d22540a64796ec2ad9844eaaec577d90b0d8d2738eea0d2041837ead7R246-R265'>lib.rs [246-265]</a> <details open><summary>Referred Code</summary> ```rust fn should_retry_grpc(err: &GrpcClientError) -> bool { matches!( err, GrpcClientError::Grpc(_) | GrpcClientError::Transport(_) ) } fn is_retryable_source_error(err: &X509SourceError) -> bool { matches!(err, X509SourceError::NoSuitableSvid) } fn is_retryable_tls_error(err: &anyhow::Error) -> bool { let msg = err.to_string(); msg.contains("no default X.509 SVID") || msg.contains("failed to fetch default X.509 SVID") || msg.contains("no X.509 bundle available") || msg.contains("failed to fetch X.509 bundle") } // Deep-merge JSON overlay into a Serialize/Deserialize config object. ``` </details></details></td></tr> <tr><td><details><summary>Unbounded retry loop </summary> Description: The SPIFFE credential loading loop retries forever with fixed 2s delay and no global timeout or cap, risking indefinite startup hang and denial of service if the Workload API never becomes available. <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-0daf4a86d7df1cacd92f6e1d97d152efc02687caad0f32eac1fcec9ebdcbe378R26-R88'>spiffe.rs [26-88]</a> <details open><summary>Referred Code</summary> ```rust loop { let client = match WorkloadApiClient::new_from_path(workload_socket).await { Ok(client) => client, Err(err) => { let mapped = map_grpc_error("connect to SPIFFE Workload API", workload_socket, err); warn!("{mapped}; retrying in {}s", retry_delay.as_secs()); sleep(retry_delay).await; continue; } }; let source = match X509SourceBuilder::new().with_client(client).build().await { Ok(source) => source, Err(X509SourceError::GrpcError(grpc_err)) => { if should_retry_grpc(&grpc_err) { warn!( "SPIFFE Workload API unavailable ({grpc_err:?}); retrying in {}s", retry_delay.as_secs() ); sleep(retry_delay).await; continue; ... (clipped 42 lines) ``` </details></details></td></tr> <tr><td><details><summary>Env secret handling </summary> Description: CNPG password is sourced from the environment and stored back into the in-memory config without masking; while common, this increases risk of accidental exposure via logs or memory dumps—ensure no logging of full config occurs and prefer file/secret mounts. <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-c9a73828b631e4618af51a47bc4c618d72ad1726fef3c3cbe12ab73b57b0eb63R67-R73'>main.go [67-73]</a> <details open><summary>Referred Code</summary> ```go // If the password is omitted from file config to keep it out of KV, pull it from the secret env. if cfg.CNPG != nil && cfg.CNPG.Password == "" { if pwd := os.Getenv("CNPG_PASSWORD"); pwd != "" { cfg.CNPG.Password = pwd } } ``` </details></details></td></tr> <tr><td colspan='2'>Ticket Compliance</td></tr> <tr><td>⚪</td><td><details><summary>🎫 No ticket provided </summary> - [ ] Create ticket/issue  </details></td></tr> <tr><td colspan='2'>Codebase Duplication Compliance</td></tr> <tr><td>⚪</td><td><details><summary>Codebase context is not defined </summary> Follow the <a href='https://qodo-merge-docs.qodo.ai/core-abilities/rag_context_enrichment/'>guide</a> to enable codebase context checks. </details></td></tr> <tr><td colspan='2'>Custom Compliance</td></tr> <tr><td rowspan=2>🟢</td><td> <details><summary>Generic: Meaningful Naming and Self-Documenting Code</summary> **Objective:** Ensure all identifiers clearly express their purpose and intent, making code self-documenting **Status:** Passed > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td> <details><summary>Generic: Robust Error Handling and Edge Case Management</summary> **Objective:** Ensure comprehensive error handling that provides meaningful context and graceful degradation **Status:** Passed > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td rowspan=4>⚪</td> <td><details> <summary>Generic: Comprehensive Audit Trails</summary> **Objective:** To create a detailed and reliable record of critical system actions for security analysis and compliance. **Status:** <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-9fcbc5358a9009e60a8cd22d21e5a9ea652787c727732d0b869e0865495114c3R34-R54'>Audit context</a>: Error paths and rule-skip decisions are logged minimally without user/device identifiers or request correlation, which may limit auditability of critical rule evaluation outcomes. <details open><summary>Referred Code</summary> ```rust let resp = match engine.evaluate(&dkey, context.clone().into()).await { Ok(r) => r, Err(e) => { if matches!( e.as_ref(), zen_engine::EvaluationError::LoaderError(le) if matches!(le.as_ref(), zen_engine::loader::LoaderError::NotFound(_)) ) { debug!("rule {dkey} not found, skipping"); continue; } let message = match e.as_ref() { zen_engine::EvaluationError::LoaderError(le) => { format!("failed to load rule {dkey}: {le}") } _ => format!("failed to evaluate rule {dkey}"), }; return Err(anyhow::Error::new(e).context(message)); } ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary>Generic: Secure Error Handling</summary> **Objective:** To prevent the leakage of sensitive system information through error messages while providing sufficient detail for internal debugging. **Status:** <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-9fcbc5358a9009e60a8cd22d21e5a9ea652787c727732d0b869e0865495114c3R46-R54'>Error detail</a>: Returned errors wrap underlying evaluation errors which may include internal rule loader details; confirm these are not surfaced to end users or insecure logs. <details open><summary>Referred Code</summary> ```rust let message = match e.as_ref() { zen_engine::EvaluationError::LoaderError(le) => { format!("failed to load rule {dkey}: {le}") } _ => format!("failed to evaluate rule {dkey}"), }; return Err(anyhow::Error::new(e).context(message)); } ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary>Generic: Secure Logging Practices</summary> **Objective:** To ensure logs are useful for debugging and auditing without exposing sensitive information like PII, PHI, or cardholder data. **Status:** <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-0ef56f7aa6d7c9dcfd75c1cce1a28e4dcd1cc78afc008386bd5918ab6f56b4eaR96-R100'>Console logging</a>: Added console logs on WebSocket close events may leak operational context in browser consoles; verify no sensitive data is included and that logging level is appropriate for production. <details open><summary>Referred Code</summary> ```typescript this.websocket.onclose = (event) => { // Provide context-aware logging for WebSocket closures if (event.code === 1006 && this.completionReceived) { console.log('✅ [StreamingClient] WebSocket closed normally after server completion (1006 is expected for legacy batch completion)'); } else if (event.code === 1000) { ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td><details> <summary>Generic: Security-First Input Validation and Data Handling</summary> **Objective:** Ensure all data inputs are validated, sanitized, and handled securely to prevent vulnerabilities **Status:** <a href='https://github.com/carverauto/serviceradar/pull/1975/files#diff-c9a73828b631e4618af51a47bc4c618d72ad1726fef3c3cbe12ab73b57b0eb63R67-R73'>Secret handling</a>: The process reads CNPG password from environment and injects into config; confirm it is not logged or exposed elsewhere and that downstream components avoid printing it. <details open><summary>Referred Code</summary> ```go // If the password is omitted from file config to keep it out of KV, pull it from the secret env. if cfg.CNPG != nil && cfg.CNPG.Password == "" { if pwd := os.Getenv("CNPG_PASSWORD"); pwd != "" { cfg.CNPG.Password = pwd } } ``` </details> > Learn more about managing compliance <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#configuration-options'>generic rules</a> or creating your own <a href='https://qodo-merge-docs.qodo.ai/tools/compliance/#custom-compliance'>custom rules</a> </details></td></tr> <tr><td align="center" colspan="2"> - [ ] Update  </td></tr></tbody></table> <details><summary>Compliance status legend</summary> 🟢 - Fully Compliant 🟡 - Partial Compliant 🔴 - Not Compliant ⚪ - Requires Further Human Verification 🏷️ - Compliance label </details>

qodo-code-review[bot] commented

2025-11-22 07:36:18 +00:00

(Migrated from github.com)

Author

Owner

Imported GitHub PR comment.

Original author: @qodo-code-review[bot]
Original URL: https://github.com/carverauto/serviceradar/pull/1975#issuecomment-3565946382
Original created: 2025-11-22T07:36:18Z

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Fix potential duplicate data insertion Revert the `ON CONFLICT` clause to use only `(id)` as the conflict target to prevent potential data duplication for events. pkg/db/events.go [52-56] `) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) -- ON CONFLICT (id) DO UPDATE SET -+ ON CONFLICT (id, event_timestamp) DO UPDATE SET + ON CONFLICT (id) DO UPDATE SET event_timestamp = EXCLUDED.event_timestamp, specversion = EXCLUDED.specversion, source = EXCLUDED.source,` `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies that changing the `ON CONFLICT` key from `(id)` to `(id, event_timestamp)` can lead to unintended data duplication, which is a significant data integrity and correctness issue.	Medium
General	✅ ~~Prevent indefinite retry loop on failure~~ Suggestion Impact: The commit introduced a maximum retry count (configurable via env var) and stopped retrying after exceeding it, returning detailed errors instead of looping indefinitely. Although it did not implement exponential backoff, it addressed the core issue of an infinite retry loop by adding a retry cap. code diff: async fn load_spiffe_tls(workload_socket: &str, trust_domain: &str) -> Result<ClientTlsConfig> { let retry_delay = Duration::from_secs(2); + let max_retries = std::env::var("KV_SPIFFE_MAX_RETRIES") + .ok() + .and_then(\|v\| v.parse::<u32>().ok()) + .filter(\|v\| v > 0) + .unwrap_or(60); let trust_domain = TrustDomain::try_from(trust_domain).map_err(\|e\| KvError::Other(e.into()))?; + let mut attempts: u32 = 0; loop { + attempts += 1; + let client = match WorkloadApiClient::new_from_path(workload_socket).await { Ok(client) => client, Err(err) => { - if should_retry_grpc(&err) { + if should_retry_grpc(&err) && attempts < max_retries { sleep(retry_delay).await; continue; } - return Err(KvError::Other(err.into())); + return Err(KvError::Other( + anyhow::anyhow!( + "failed to connect to SPIFFE Workload API after {attempts} attempts: {err}" + ) + .into(), + )); } }; let source = match X509SourceBuilder::new().with_client(client).build().await { Ok(source) => source, Err(X509SourceError::GrpcError(grpc_err)) => { - if should_retry_grpc(&grpc_err) { + if should_retry_grpc(&grpc_err) && attempts < max_retries { sleep(retry_delay).await; continue; } - return Err(KvError::Other(grpc_err.into())); + return Err(KvError::Other( + anyhow::anyhow!( + "failed to initialize SPIFFE X.509 source after {attempts} attempts: {grpc_err}" + ) + .into(), + )); } Err(other) => { - if is_retryable_source_error(&other) { + if is_retryable_source_error(&other) && attempts < max_retries { sleep(retry_delay).await; continue; } - return Err(KvError::Other(other.into())); + return Err(KvError::Other( + anyhow::anyhow!( + "failed to initialize SPIFFE X.509 source after {attempts} attempts: {other}" + ) + .into(), + )); } }; @@ -189,6 +212,14 @@ return Ok(tls); } Err(err) if is_retryable_tls_error(&err) => { + if attempts >= max_retries { + return Err(KvError::Other( + anyhow::anyhow!( + "failed to load SPIFFE TLS materials after {attempts} attempts: {err}" + ) + .into(), + )); + } sleep(retry_delay).await; continue; } Modify the retry logic in `load_spiffe_tls` to use a retry limit and exponential backoff instead of an indefinite loop with a fixed delay to prevent permanent busy-loops on non-transient errors. rust/kvutil/src/lib.rs [142-198] async fn load_spiffe_tls(workload_socket: &str, trust_domain: &str) -> Result<ClientTlsConfig> { - let retry_delay = Duration::from_secs(2); + let mut retry_delay = Duration::from_secs(2); + const MAX_RETRIES: u32 = 10; let trust_domain = TrustDomain::try_from(trust_domain).map_err(\|e\| KvError::Other(e.into()))?; - loop { + for attempt in 0..MAX_RETRIES { let client = match WorkloadApiClient::new_from_path(workload_socket).await { Ok(client) => client, Err(err) => { if should_retry_grpc(&err) { sleep(retry_delay).await; + retry_delay = 2; continue; } return Err(KvError::Other(err.into())); } }; let source = match X509SourceBuilder::new().with_client(client).build().await { Ok(source) => source, Err(X509SourceError::GrpcError(grpc_err)) => { if should_retry_grpc(&grpc_err) { sleep(retry_delay).await; + retry_delay = 2; continue; } return Err(KvError::Other(grpc_err.into())); } Err(other) => { if is_retryable_source_error(&other) { sleep(retry_delay).await; + retry_delay = 2; continue; } return Err(KvError::Other(other.into())); } }; let guard = SpiffeSourceGuard { source, trust_domain: trust_domain.clone(), }; match guard.tls_materials() { Ok((identity, ca)) => { let mut tls = ClientTlsConfig::new().ca_certificate(ca).identity(identity); if let Ok(server_name) = std::env::var("KV_SERVER_NAME") { if !server_name.trim().is_empty() { tls = tls.domain_name(server_name); } } return Ok(tls); } Err(err) if is_retryable_tls_error(&err) => { sleep(retry_delay).await; + retry_delay *= 2; continue; } Err(err) => return Err(KvError::Other(err.into())), } } + + Err(KvError::Other(anyhow::anyhow!("Failed to load SPIFFE TLS config after {} attempts", MAX_RETRIES).into())) } `[To ensure code accuracy, apply this suggestion manually]` Suggestion importance[1-10]: 7 __ Why: The suggestion correctly points out that the indefinite retry loop can hide permanent failures and consume resources, proposing a more robust retry mechanism with a limit and backoff, which is a good practice for resilience.	Medium
Update

Imported GitHub PR comment. Original author: @qodo-code-review[bot] Original URL: https://github.com/carverauto/serviceradar/pull/1975#issuecomment-3565946382 Original created: 2025-11-22T07:36:18Z --- ## PR Code Suggestions ✨  Explore these optional code suggestions: <table><thead><tr><td>Category</td><td align=left>Suggestion                                                                                                                                    </td><td align=center>Impact</td></tr><tbody><tr><td rowspan=1>Possible issue</td> <td> <details><summary>Fix potential duplicate data insertion</summary> ___ **Revert the <code>ON CONFLICT</code> clause to use only <code>(id)</code> as the conflict target to prevent potential data duplication for events.** [pkg/db/events.go [52-56]](https://github.com/carverauto/serviceradar/pull/1975/files#diff-bf1824600585d423d03392632872269bf1d5f976430b55d7a9bd1238bc8de6b5R52-R56) ```diff ) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14) -- ON CONFLICT (id) DO UPDATE SET -+ ON CONFLICT (id, event_timestamp) DO UPDATE SET + ON CONFLICT (id) DO UPDATE SET event_timestamp = EXCLUDED.event_timestamp, specversion = EXCLUDED.specversion, source = EXCLUDED.source, ``` `[To ensure code accuracy, apply this suggestion manually]` <details><summary>Suggestion importance[1-10]: 8</summary> __ Why: The suggestion correctly identifies that changing the `ON CONFLICT` key from `(id)` to `(id, event_timestamp)` can lead to unintended data duplication, which is a significant data integrity and correctness issue. </details></details></td><td align=center>Medium </td></tr><tr><td rowspan=1>General</td> <td> <details><summary>✅ <s>Prevent indefinite retry loop on failure</s></summary> ___ <details><summary>Suggestion Impact:</summary>The commit introduced a maximum retry count (configurable via env var) and stopped retrying after exceeding it, returning detailed errors instead of looping indefinitely. Although it did not implement exponential backoff, it addressed the core issue of an infinite retry loop by adding a retry cap. code diff: ```diff async fn load_spiffe_tls(workload_socket: &str, trust_domain: &str) -> Result<ClientTlsConfig> { let retry_delay = Duration::from_secs(2); + let max_retries = std::env::var("KV_SPIFFE_MAX_RETRIES") + .ok() + .and_then(|v| v.parse::<u32>().ok()) + .filter(|v| *v > 0) + .unwrap_or(60); let trust_domain = TrustDomain::try_from(trust_domain).map_err(|e| KvError::Other(e.into()))?; + let mut attempts: u32 = 0; loop { + attempts += 1; + let client = match WorkloadApiClient::new_from_path(workload_socket).await { Ok(client) => client, Err(err) => { - if should_retry_grpc(&err) { + if should_retry_grpc(&err) && attempts < max_retries { sleep(retry_delay).await; continue; } - return Err(KvError::Other(err.into())); + return Err(KvError::Other( + anyhow::anyhow!( + "failed to connect to SPIFFE Workload API after {attempts} attempts: {err}" + ) + .into(), + )); } }; let source = match X509SourceBuilder::new().with_client(client).build().await { Ok(source) => source, Err(X509SourceError::GrpcError(grpc_err)) => { - if should_retry_grpc(&grpc_err) { + if should_retry_grpc(&grpc_err) && attempts < max_retries { sleep(retry_delay).await; continue; } - return Err(KvError::Other(grpc_err.into())); + return Err(KvError::Other( + anyhow::anyhow!( + "failed to initialize SPIFFE X.509 source after {attempts} attempts: {grpc_err}" + ) + .into(), + )); } Err(other) => { - if is_retryable_source_error(&other) { + if is_retryable_source_error(&other) && attempts < max_retries { sleep(retry_delay).await; continue; } - return Err(KvError::Other(other.into())); + return Err(KvError::Other( + anyhow::anyhow!( + "failed to initialize SPIFFE X.509 source after {attempts} attempts: {other}" + ) + .into(), + )); } }; @@ -189,6 +212,14 @@ return Ok(tls); } Err(err) if is_retryable_tls_error(&err) => { + if attempts >= max_retries { + return Err(KvError::Other( + anyhow::anyhow!( + "failed to load SPIFFE TLS materials after {attempts} attempts: {err}" + ) + .into(), + )); + } sleep(retry_delay).await; continue; } ``` </details> ___ **Modify the retry logic in <code>load_spiffe_tls</code> to use a retry limit and exponential backoff instead of an indefinite loop with a fixed delay to prevent permanent busy-loops on non-transient errors.** [rust/kvutil/src/lib.rs [142-198]](https://github.com/carverauto/serviceradar/pull/1975/files#diff-91f4558d22540a64796ec2ad9844eaaec577d90b0d8d2738eea0d2041837ead7R142-R198) ```diff async fn load_spiffe_tls(workload_socket: &str, trust_domain: &str) -> Result<ClientTlsConfig> { - let retry_delay = Duration::from_secs(2); + let mut retry_delay = Duration::from_secs(2); + const MAX_RETRIES: u32 = 10; let trust_domain = TrustDomain::try_from(trust_domain).map_err(|e| KvError::Other(e.into()))?; - loop { + for attempt in 0..MAX_RETRIES { let client = match WorkloadApiClient::new_from_path(workload_socket).await { Ok(client) => client, Err(err) => { if should_retry_grpc(&err) { sleep(retry_delay).await; + retry_delay *= 2; continue; } return Err(KvError::Other(err.into())); } }; let source = match X509SourceBuilder::new().with_client(client).build().await { Ok(source) => source, Err(X509SourceError::GrpcError(grpc_err)) => { if should_retry_grpc(&grpc_err) { sleep(retry_delay).await; + retry_delay *= 2; continue; } return Err(KvError::Other(grpc_err.into())); } Err(other) => { if is_retryable_source_error(&other) { sleep(retry_delay).await; + retry_delay *= 2; continue; } return Err(KvError::Other(other.into())); } }; let guard = SpiffeSourceGuard { source, trust_domain: trust_domain.clone(), }; match guard.tls_materials() { Ok((identity, ca)) => { let mut tls = ClientTlsConfig::new().ca_certificate(ca).identity(identity); if let Ok(server_name) = std::env::var("KV_SERVER_NAME") { if !server_name.trim().is_empty() { tls = tls.domain_name(server_name); } } return Ok(tls); } Err(err) if is_retryable_tls_error(&err) => { sleep(retry_delay).await; + retry_delay *= 2; continue; } Err(err) => return Err(KvError::Other(err.into())), } } + + Err(KvError::Other(anyhow::anyhow!("Failed to load SPIFFE TLS config after {} attempts", MAX_RETRIES).into())) } ``` `[To ensure code accuracy, apply this suggestion manually]` <details><summary>Suggestion importance[1-10]: 7</summary> __ Why: The suggestion correctly points out that the indefinite retry loop can hide permanent failures and consume resources, proposing a more robust retry mechanism with a limit and backoff, which is a good practice for resilience. </details></details></td><td align=center>Medium </td></tr> <tr><td align="center" colspan="2"> - [ ] Update  </td><td></td></tr></tbody></table>