mirror of
https://github.com/mulgadc/spinifex.git
synced 2026-10-15 17:11:30 +00:00
joshsiv-mulga
72353e476c
The image-pull storage-growth workload HEADed <volID>/checkpoints/blocks.live.bin with the operator box's gateway identity, which has no S3 read grant on the bucket and was refused 403 on every sample, so checkpoint_bytes read 0 across a whole run. It now HEADs the object on the node over PeerSSH using predastore's own [[auth]] credentials from predastore.toml (root-owned, so read via passwordless sudo; the CA is readable through the spinifex group). The credentials are read into shell locals, used inline for one aws s3api head-object, then unset — never echoed, never leaving the node. A probe failure that is not a legitimate 404 voids the sample (checkpoint_bytes -1 plus a probe error) rather than reporting a false zero, so a dead instrument can never look like no growth. The dead operator-side S3 client path is removed.