fix(security): close Sentinel 0.0.0.0:8719 exposure; add load-test tooling (S34) - #2
Merged
Merged
Conversation
…oling (S34) Sentinel's transport/command-center listener was binding 0.0.0.0:8719 despite Sentinel being completely unused (confirmed via bytecode inspection - zero @SentinelResource/flow-rule usage anywhere in any service). Disable it via spring.cloud.sentinel.enabled=false in the shared systemd unit template (config-only, no rebuild required; applies to all 14 services on next restart). Also, alongside redeploying order-service/payment-sim-service to pick up the already-committed S33 source (their jars had gone stale - see AGENTS.md S34 entry for the full writeup): - Extend scripts/check-deployment.sh with S33 internal-only-path and driver-review RBAC re-verification, plus an INFO-only baseline of the two documented, deliberately-deferred security gaps in docs/security.md. - Add docs/load-testing.md: a static, config-derived capacity analysis (no synthetic load generated against the production host, which is already structurally memory-oversubscribed at idle). - Add scripts/loadtest/ (k6 scripts modeling the existing demo-smoke.sh flow plus a rate-limit boundary probe) - guarded to refuse running against the known production host. - Ignore local jar backups created during the redeploy. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
0.0.0.0:8719(verified via bytecode inspection that Sentinel is 100% unused — zero@SentinelResource/flow-rule usage anywhere). Disabled viaspring.cloud.sentinel.enabled=falsein the shared systemd unit template (config-only, applies to all 14 services on next restart; gateway-service and the two services below have already been restarted live and confirmed closed viass -tlnp).order-service/payment-sim-servicelive (out of band from this diff — no source changes needed) to pick up the already-merged S33 commit; their jars had gone stale due to the Maven incremental-repackaging pitfall documented inAGENTS.md.scripts/check-deployment.shwith S33 internal-only-path + driver-review RBAC re-verification, plus an INFO-only baseline of the two documented, deliberately-deferred security gaps indocs/security.md(confirmed unchanged).docs/load-testing.md: a static, config-derived capacity analysis — no synthetic load was generated against the production host, which is already structurally memory-oversubscribed at idle (14 services'MemoryMax+ 5 middleware containers = ~138% of total physical RAM).scripts/loadtest/(k6 scripts modeling the existingdemo-smoke.shflow, plus a rate-limit boundary probe) — guarded insetup()to refuse running against the known production host.Test plan
scripts/check-deployment.shagainst the live gateway —ALL CHECKS PASSEDscripts/demo-smoke.shfull 13-step flow —FAILS=0order-service/payment-sim-service, one at a time, health-gated — both healthy in ~25s, no crash-loopss -tlnp | grep 8719before/after gateway restart — confirmed closednode --checksyntax validation on the new k6 scripts (k6 itself intentionally not installed/run on this host)🤖 Generated with Claude Code