carlos / platform Public

Download this file

1	# Approval plan: the db-reads/ lifecycle rule on the deployment buckets
2
3	Status: PREPARED, not applied. AGENTS.md's production rule applies: nothing
4	here is applied until Paul approves this scope.
5
6	## What and why
7
8	Two lifecycle rules on each deployment bucket, both filtered to the prefix
9	`db-reads/` (db region forward spec §5.7, §11.1, J4):
10
11	- `db-reads-expire`: current versions expire 1 day after creation;
12	noncurrent versions expire 1 day after they become noncurrent; incomplete
13	multipart uploads are aborted after 1 day.
14	- `db-reads-delete-markers`: expired object delete markers are removed.
15
16	The forwarded read protocol writes create-only objects under `db-reads/`
17	and deletes nothing. These rules are its only deletion. They must be in
18	place on a deployment's bucket before any console there sets
19	`CARLOS_DB_FORWARD=1`; without them `db-reads/` objects are never removed.
20
21	The module change is in `infra/modules/deployment-buckets/main.tf`, inside
22	the existing `aws_s3_bucket_lifecycle_configuration.deployment`, beside the
23	`geoip-noncurrent` rule, which is unchanged. The module test
24	`tests/db_reads.tftest.hcl` (T17) pins both rules and the GeoIP rule.
25
26	## Scope
27
28	| | Dev | Flagship |
29	|---|---|---|
30	| Account and region | the dev account (profile `kass`), eu-west-1 | the flagship account (profile `keymail`), eu-west-1 |
31	| Bucket | `carlos-dev-640012953448` | `carlos-flagship-271376211898` |
32	| Root | `platform-infrastructure` (tracks `main`) | `carlosframework/carloku-infrastructure` (modules at a release tag) |
33	| Resource | `aws_s3_bucket_lifecycle_configuration.deployment` inside the `deployment-buckets` module | the same |
34	| Change | two rules added; the `control/geoip/` rule unchanged | the same |
35
36	No IAM change, no new permission, no traffic change. Nothing outside
37	`db-reads/` is affected: the filter is the prefix, and no other key in the
38	bucket starts with it. A bucket's lifecycle configuration is replaced whole
39	by the apply, which is why the plan must show the GeoIP rule still there.
40
41	## Cost
42
43	Lifecycle expiration is free. Storage of `db-reads/` objects is at most a
44	few days of forwarded reads (a query's ciphertext is at most 64 MiB).
45
46	## Steps
47
48	Dev first (Paul's roll order), then the flagship:
49
50	1. Dev: in `platform-infrastructure`, `tofu init -upgrade`, then
51	`tofu plan -target=<the deployment-buckets module address>` (find it
52	with `grep -n 'deployment-buckets' *.tf`). The plan must show only the
53	lifecycle configuration changing in place, with the two rules added and
54	`geoip-noncurrent` kept. Apply with the same `-target` after approval.
55	2. Flagship: cut the platform release that carries this module change,
56	push its tag to the GitHub mirror (`git push
57	https://github.com/carlosframework/platform.git refs/tags/vX.Y.Z`), bump
58	every `?ref=` in `carloku-infrastructure`, `tofu init -upgrade`, then the
59	same targeted plan. Apply with the same `-target` after approval. A
60	whole-root apply is not allowed (user_data drift restarts every box).
61
62	## Verification
63
64	`aws s3api get-bucket-lifecycle-configuration --bucket <deployment bucket>
65	--profile <the deployment's profile>` lists `geoip-noncurrent`,
66	`db-reads-expire` and `db-reads-delete-markers`, the last two filtered to
67	`db-reads/`.
68
69	## Rollback
70
71	Remove the two rules and apply the same targeted change. Until a rule is
72	back, `db-reads/` objects are not removed, so turn forwarding off
73	(`CARLOS_DB_FORWARD` unset on the console) first.
74
75	## Duration
76
77	Permanent while forwarding is in use. Plan 5 (spec §14) moves this traffic
78	to a bucket per region, which carries its own copy of these rules; these
79	then stay for any object written before the move.
80