hotfix(security): drop global Database Query plugin block#1339
Merged
Conversation
Migration 0082 installed block_database_integration_type on integrations, refusing every INSERT/UPDATE that set type='database' so the DB Query plugin was disabled for everyone during the active incident. That block is no longer the right gate. The other defences from incident response are sufficient and stay in place: - block_executions trigger on workflow_executions rejects inserts when the workflow owner is deactivated_at IS NOT NULL or the workflow itself is deleted_at IS NOT NULL (migration 0082) - SSRF guard parity across HTTP and database plugin SQL paths (KEEP-603) - NetworkPolicy on workflow-runner pods blocks egress to 169.254.0.0/16, fe80::/10, fc00::/7 - IMDSv2 hop-limit=1 on Karpenter NodeClasses - Compromised user accounts hard-deleted, their channels (sessions, OAuth, api_keys, org_api_keys, integrations) wiped Legitimate operators (Sky engineers monitoring chief-keeper-spells, Neon analytics DBs etc.) need the DB Query plugin back to re-create their integrations after the incident-wide credential rotation. The trigger is already dropped on prod via direct DB action during incident response; this migration brings the migration history in line so a fresh DB built from migrations matches prod. Idempotent via IF EXISTS.
🧹 PR Environment Cleaned UpThe PR environment has been successfully deleted. Deleted Resources:
All resources have been cleaned up and will no longer incur costs. |
ℹ️ No PR Environment to Clean UpNo PR environment was found for this PR. This is expected if:
|
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Drops the
block_database_integration_typetrigger installed during the 2026-05-21 incident (migration 0082). The trigger refused everyINSERT/UPDATEonintegrationswheretype='database', disabling the DB Query plugin for everyone while the active attack was being contained.That block is no longer the right gate. Other defences remain in place:
block_executionstrigger onworkflow_executions(migration 0082) rejects inserts when the workflow owner isdeactivated_at IS NOT NULLor the workflow isdeleted_at IS NOT NULLblock_user_signuptrigger onusersallows only@techops.services/@keeperhub.comsignups169.254.0.0/16,fe80::/10,fc00::/7Legitimate operators (Sky engineers monitoring chief-keeper-spells, Neon analytics DBs etc.) need the DB Query plugin back to re-create their integrations after the incident-wide credential rotation.
State on prod
The trigger + function were already dropped on the prod DB earlier today via direct DDL during incident response. This migration is idempotent via
IF EXISTS, so the nextpnpm db:migrateon prod is a no-op for the trigger drop but advances the journal to record the change.Test plan
DROP TRIGGER IF EXISTS,DROP FUNCTION IF EXISTS)pnpm db:migrateadvances the journal cleanlypnpm db:migrateadvances the journal cleanly; the trigger remains absent (already dropped)