2 Commits

Author	SHA1	Message	Date
shankar0123	1279172e9b	loadtest: close Phase 8 SCALE-H2 — add scale-tier scenarios ... Phase 8 of the certctl architecture diligence remediation closes SCALE-H2 by adding three new k6 scenarios that exercise the scale- relevant load surfaces the API tier + connector tier left uncovered: fleet-scale bulk renewal, ACME enrollment burst, and agent heartbeat storm. Audit miscount + path correction (live-grep at Phase 8 audit time) ================================================================== - The Phase 8 prompt referenced both `deploy/test/load/` and `deploy/test/loadtest/`. Repo truth: the existing harness lives at `deploy/test/loadtest/`. New scenarios land there. - The audit's prior framing "k6 covers the API tier at 50 req/s only" omitted Bundle 10 (2026-05-02) which added four connector- tier handshake scenarios (nginx/apache/haproxy/f5) at 100 conns/min each, plus the Phase 5 ACME directory/nonce/ARI scenario at 100 VUs in `k6/acme_flow.js`. Phase 8 appends to what's there rather than rewriting. What ships ========== Three new k6 scenario files under deploy/test/loadtest/k6/: bulk_renewal.js — 10K-cert seed + 5 req/s POST /bulk-renew × 5min p99 < 5s, p95 < 2s, errors < 1% acme_burst.js — 200 VU sustained × directory/nonce/ARI × 5min directory p95 < 500ms, nonce p95 < 300ms, renewal-info p95 < 800ms, 5xx-only < 0.1% Pins RFC 7807 rate-limit response shape via acme_rate_limit_shape_ok Counter. agent_storm.js — 5K-agent seed + 167 req/s POST /heartbeat × 5min p99 < 1s, p95 < 500ms, errors < 0.1% Two seed SQL fixtures under deploy/test/loadtest/seed/: 01_bulk_renewal_certs.sql — 10,000 managed_certificates rows linked to seed_demo.sql FKs (iss-local, o-alice, t-platform, rp-standard). status='active', expires_at distributed across next 30 days, name prefix `loadtest-bulk-` so the scenario can scope its criteria. Idempotent via ON CONFLICT (name) DO NOTHING. 02_agent_fleet.sql — 5,000 agents rows with name prefix `loadtest-agent-`. status='Online', last_heartbeat_at staggered across prior 60s, OS distribution 80%/10%/10% linux/windows/darwin. Idempotent via ON CONFLICT (id) DO NOTHING. Plus seed/README.md documenting the opt-in profile + when these run vs the default `make loadtest` fast path. Compose + Makefile + CI wiring ============================== deploy/test/loadtest/docker-compose.yml gains four new services, all gated behind the `scale` compose profile so the default `make loadtest` is unchanged: scale-seed — one-shot postgres:16-alpine container that runs every ./seed/*.sql in lexical order against the same postgres the server uses. Depends on postgres healthy + certctl-server healthy (so migrations + seed_demo.sql have already run). k6-scale-bulk — grafana/k6:0.54.0 driver running bulk_renewal.js k6-scale-acme — grafana/k6:0.54.0 driver running acme_burst.js k6-scale-agent — grafana/k6:0.54.0 driver running agent_storm.js Each driver depends_on scale-seed completed_successfully so the scenarios never run against an unseeded DB (the acme scenario doesn't need the seed itself but uses the same dependency chain for ordering predictability). Makefile gains four new phony targets: loadtest-scale-bulk - runs bulk_renewal.js via compose --profile scale loadtest-scale-acme - runs acme_burst.js loadtest-scale-agent - runs agent_storm.js loadtest-scale - all three serially .github/workflows/loadtest.yml gains a new k6-scale matrix job that runs after the existing k6 job (needs: k6) with a matrix on the three scenarios — fail-fast: false so a regression in one scenario doesn't cancel the others. Same workflow_dispatch + weekly cron cadence as the existing API + connector tier job. Documentation ============= docs/operator/scale.md gains a new "Scale-tier scenarios (SCALE-H2, Phase 8)" section between the cursor-pagination subsection and the profiling-production subsection. Documents: - Scenario + seed + sustained load table - Threshold contract (regression guards, NOT measured baselines) - Measured-baseline table with TBD placeholders + the canonical- hardware capture procedure - How to run the scale tier locally - Four documented limitations (JWS-signed ACME, scheduler renewal scan throughput, production-sized Postgres, pull-only deployment model) deploy/test/loadtest/README.md gains a short "Scale tier (Phase 8 SCALE-H2, 2026-05-14)" section pointing at scale.md as the canonical operator-facing baseline source. Avoids duplication; the README remains the harness-mechanics doc. Deliberate deviations from the prompt ====================================== The Phase 8 prompt's "concrete deliverables" section referenced `deploy/test/load/` (no -test) for the new k6 files. The actual harness lives at `deploy/test/loadtest/` — the new files land there to match existing convention. The prompt's audit-questions section also referenced `deploy/test/loadtest/` so the prompt was internally inconsistent on this; repo truth wins. The prompt described the ACME burst as "200 concurrent ACME orders against /acme/profile/<id>/new-order ... pin the rate-limit response shape." new-order is JWS-signed (RFC 8555 §7.4 requires JWS for every POST except newAccount-pre-account-key flows). k6 doesn't ship JWS and bundling a signer (e.g. lego) into the k6 container would obscure the server-side latency the scenario is trying to measure. Same trade-off the existing Phase 5 acme_flow.js made. Phase 8's acme_burst.js measures the unauthenticated directory + nonce + ARI surface at burst rate AND pins the 429 rate-limit response shape via a custom Counter that increments only when the response is `application/problem+json` with the `urn:ietf:params:acme:error:rateLimited` type. End-to-end JWS conformance under load remains a follow-up; the canonical JWS correctness gate is `make acme-rfc-conformance-test` (lego-based, non-load). Deferred (operator-side, not engineering) ========================================== Canonical-hardware baseline capture. The TBD placeholders in docs/operator/scale.md's measured-baseline table are intentional — sandbox-captured numbers from a developer laptop are misleading (same anti-pattern the original loadtest README guards against). Operator triggers loadtest.yml from the Actions tab, waits for the k6-scale matrix jobs to complete, downloads the per-scenario summary artifacts, copies p50/p95/p99 into the table, commits the captured numbers alongside the date + commit SHA. Files changed (10): .github/workflows/loadtest.yml (+72 -1) Makefile (+47 -1) deploy/test/loadtest/README.md (+28 -1) deploy/test/loadtest/docker-compose.yml (+108 -1) deploy/test/loadtest/k6/bulk_renewal.js (new, 106 lines) deploy/test/loadtest/k6/acme_burst.js (new, 192 lines) deploy/test/loadtest/k6/agent_storm.js (new, 124 lines) deploy/test/loadtest/seed/01_bulk_renewal_certs.sql (new, 95 lines) deploy/test/loadtest/seed/02_agent_fleet.sql (new, 92 lines) deploy/test/loadtest/seed/README.md (new, 86 lines) docs/operator/scale.md (+109 -0) Verification (sandbox-runnable): python3 -c 'import yaml; yaml.safe_load(open("deploy/test/loadtest/docker-compose.yml"))' → compose YAML OK python3 -c 'import yaml; yaml.safe_load(open(".github/workflows/loadtest.yml"))' → workflow YAML OK grep -E 'bulk_renewal|acme_burst|agent_storm' deploy/test/loadtest/k6/*.js → all three scenarios + tags present grep loadtest-scale Makefile → 4 new targets registered in .PHONY + 3 recipes + 1 aggregate Runtime verification (deferred — requires docker on canonical hardware): make loadtest-scale-bulk # 10K cert fixture + 5 req/s × 5min make loadtest-scale-acme # 200 VU × 5min make loadtest-scale-agent # 5K agent fixture + 167 req/s × 5min make loadtest-scale # all three serially Closes: cowork/certctl-architecture-diligence-audit.html#fix-SCALE-H2	2026-05-14 03:25:15 +00:00
shankar0123	bee47f0318	acme-server: cert-manager integration test + production hardening (Phase 5/7) ... Closes the production-readiness loop on the ACME surface. After this commit, certctl ships per-account rate limits + a GC sweeper for expired ACME state + a kind-driven cert-manager 1.15 integration test + a lego-driven RFC conformance harness + a k6 loadtest scenario for the unauthenticated ACME path. Architecture: - Rate limits live in-memory + per-replica. Restart wipes the counters; orders/hour caps are eventual-consistency anyway. A 3-replica certctl-server fleet behind an LB effectively has 3x the configured throughput per account; persistent rate limiting is a follow-up if production telemetry shows abuse patterns we can't catch in a single restart cycle. Per-key + per-action isolation: ActionNewOrder/acc-1, ActionKeyChange/acc-1, and ActionChallengeRespond/<challenge-id> are independent buckets. - GC loop follows the existing scheduler-loop pattern (atomic.Bool + sync.WaitGroup; see crlGenerationLoop for shape). Three independent SQL sweeps per tick (DELETE expired nonces; UPDATE pending authzs whose expires_at < now() to expired; UPDATE pending/ready/processing orders whose expires_at < now() to invalid). Each sweep is a single statement; failures are logged- and-continued so a failing nonces sweep doesn't block authzs. Per-sweep 1m timeout bounds a stuck Postgres. - cert-manager integration test is gated on KIND_AVAILABLE so CI skips it cleanly (kind is too heavy for per-PR). Operators run locally via 'make acme-cert-manager-test'; the harness brings up a fresh cluster each run + tears it down on Cleanup. - lego conformance harness drives a real ACME client through register → run → cert-PEM-landed against a hermetic certctl stack. Catches RFC-shape regressions third-party clients would hit before they ship. - k6 ACME-flow scenario hammers the unauthenticated surface (directory + new-nonce + ARI synthetic-id) at 100 VUs × 5m. JWS- signed flows are out of scope for k6 (no JWS support); they're covered by the lego harness above. What ships: - internal/api/acme/ratelimit.go (+ ratelimit_test.go: 7 cases — disable-when-perHour-zero, capacity, per-key isolation, per- action isolation, refill-over-time, RetryAfter, concurrent-access with -race + 200 goroutines × 200 calls). - internal/repository/postgres/acme.go: 4 new methods — CountActiveOrdersByAccount + GCExpiredNonces + GCExpireAuthorizations + GCInvalidateExpiredOrders. Each a single SQL statement. - internal/service/acme.go: SetRateLimiter + GarbageCollect + rate-limit gates at 3 entry points (CreateOrder + RotateAccountKey + RespondToChallenge) + concurrent-orders gate at CreateOrder. 2 new sentinels (ErrACMERateLimited, ErrACMEConcurrentOrdersExceeded); 5 new GC metrics (gc_runs / gc_run_failures / gc_nonces_reaped / gc_authzs_expired / gc_orders_invalidated). - internal/scheduler/scheduler.go: ACMEGarbageCollector interface + acmeGCRunning atomic.Bool + acmeGCInterval + 2 setters (SetACME- GarbageCollector + SetACMEGCInterval) + acmeGCLoop following the crlGenerationLoop shape. - internal/api/handler/acme.go: writeServiceError gains rateLimited (429 + RFC 8555 §6.7) + concurrent-orders-exceeded mappings. - internal/config/config.go: 5 new env vars (CERTCTL_ACME_SERVER_RATE_LIMIT_ORDERS_PER_HOUR=100, CERTCTL_ACME_SERVER_RATE_LIMIT_CONCURRENT_ORDERS=5, CERTCTL_ACME_SERVER_RATE_LIMIT_KEY_CHANGE_PER_HOUR=5, CERTCTL_ACME_SERVER_RATE_LIMIT_CHALLENGE_RESPONDS_PER_HOUR=60, CERTCTL_ACME_SERVER_GC_INTERVAL=1m). - cmd/server/main.go: NewRateLimiter() + SetRateLimiter() at startup; conditional SetACMEGarbageCollector(acmeService) + SetACMEGCInterval(cfg.ACMEServer.GCInterval) when Enabled+ GCInterval > 0. - deploy/test/acme-integration/: kind-config.yaml + cert-manager- install.sh + clusterissuer-trust-authenticated.yaml + clusterissuer-challenge.yaml + certificate-test.yaml + conformance- lego.sh + certmanager_test.go (//go:build integration + KIND_AVAILABLE gate). - deploy/test/loadtest/k6/acme_flow.js + README ACME-flows section. - Makefile: 2 new PHONY targets (acme-cert-manager-test + acme-rfc-conformance-test). - docs/acme-server.md: status flipped to Phase 5; Configuration table grows 5 rows; new 'Phase 5 — operational guidance' section explaining rate-limit math + GC sweeper semantics + cert-manager integration + lego conformance + k6 baseline. Tests: - 'go vet ./...' clean across the repo. - 'go test -short -count=1 ./internal/...' green across every affected package (service / acme / handler / scheduler / repo / config). - 'go vet -tags=integration ./deploy/test/acme-integration/' clean (the integration test compiles cleanly with the build tag). - The kind/cert-manager harness is gated behind KIND_AVAILABLE so CI skips by default; operators run locally via 'make acme-cert- manager-test'. Engineering history: cowork/WORKSPACE-CHANGELOG.md 'ACME-Server-5'.	2026-05-03 19:42:03 +00:00