Skip to content

release: To Prod (drop DB integration block migration)#1340

Merged
OleksandrUA merged 1 commit into
prodfrom
staging
May 21, 2026
Merged

release: To Prod (drop DB integration block migration)#1340
OleksandrUA merged 1 commit into
prodfrom
staging

Conversation

@OleksandrUA
Copy link
Copy Markdown

Summary

Release staging -> prod. Contains the follow-up to the 2026-05-21 incident:

Drop global Database Query plugin block (#1339, migration 0083)

  • Drops the block_database_integration_type trigger on integrations (installed by migration 0082 to disable DB Query plugin globally during the active incident).
  • Idempotent via DROP TRIGGER IF EXISTS / DROP FUNCTION IF EXISTS.
  • Already removed on the prod DB via direct DDL during incident response; this PR brings the migration source-of-truth in line with prod state.

Other defences from the incident remain in place:

  • block_executions trigger on workflow_executions
  • block_user_signup trigger on users
  • SSRF guard parity across HTTP and database plugin SQL paths
  • NetworkPolicy on workflow-runner pods (IMDS + link-local + ULA blocked)
  • IMDSv2 hop-limit=1 on Karpenter NodeClasses

Test plan

  • CI green on PR hotfix(security): drop global Database Query plugin block #1339 before staging merge
  • Staging deploy succeeded (run 26241318512)
  • CI green on this PR before prod merge
  • After prod merge: pnpm db:migrate advances journal cleanly; trigger remains absent (already dropped)
  • Confirm Sky engineers can re-create DB integrations after this lands

@OleksandrUA OleksandrUA merged commit adaabe1 into prod May 21, 2026
23 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant