ROX-32848: Emit VM index ACK/NACK from Central#19323
Draft
vikin91 wants to merge 1 commit intopiotr/ROX-32316-sensor-vm-ack-forwardingfrom
Draft
ROX-32848: Emit VM index ACK/NACK from Central#19323vikin91 wants to merge 1 commit intopiotr/ROX-32316-sensor-vm-ack-forwardingfrom
vikin91 wants to merge 1 commit intopiotr/ROX-32316-sensor-vm-ack-forwardingfrom
Conversation
Central's VM index pipeline was missing ACK/NACK responses, breaking the end-to-end ACK flow. Adds ACK on successful enrichment+store and NACK when the rate limiter drops a report. ACKs are gated behind the SensorACKSupport capability so older Sensors are unaffected.
Contributor
Author
|
This change is part of the following stack: Change managed by git-spice. |
|
Skipping CI for Draft Pull Request. |
Contributor
|
Images are ready for the commit at 9192241. To use with deploy scripts, first |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## piotr/ROX-32316-sensor-vm-ack-forwarding #19323 +/- ##
============================================================================
- Coverage 49.58% 49.58% -0.01%
============================================================================
Files 2690 2690
Lines 203065 203088 +23
============================================================================
+ Hits 100699 100703 +4
- Misses 94869 94885 +16
- Partials 7497 7500 +3
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Completes the end-to-end ACK loop for VM index reports. Previously, Central processed VM index
reports successfully but never sent any acknowledgement back — Sensor's handler had the forwarding
logic but was never triggered, and compliance's UMH kept retrying indefinitely.
Changes in Central (the missing piece):
virtualmachineindex/pipeline.go: SendsSensorACK(ACK)after successful vulnerabilityenrichment and DB store.
SendSensorACKis gated behindSensorACKSupportcapability soolder Sensors (pre-4.10) are unaffected.
connection_impl.go: When the rate limiter drops aVirtualMachineIndexReport, sendsSensorACK(NACK)with the rate limit reason so Sensor/compliance can act on it.Changes in Sensor:
handler_impl.go: Translates Central'sSensorACKintoComplianceACKand forwards it tocompliance via a new
toCompliancechannel. ImplementsComplianceComponentinterface(
ComplianceC(),Stopped()). DeclaresSensorACKSupportcapability.sensor.go: Registers the VM handler on the compliance multiplexer.The full ACK flow is now:
Last PR in the ROX-32316 stack. Depends on:
piotr/ROX-32316-vm-relay-ack-flow.AI-assisted: implementation and tests generated by AI based on user requirements
(ACK on success, NACK on rate limit, capability gating). Reviewed and verified by the author.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
Ran all affected test suites locally:
Deployed the full stack to a cluster with a single VM. Before the fix, compliance logs showed
[vm-index] Resource 2759316682 has N unacked messages, suggesting retry ...indefinitely.After the fix, the retry stops after the first ACK from Central.
Verified the rate limiter NACK path by configuring a low
ROX_VM_INDEX_REPORT_RATE_LIMITandconfirming compliance receives NACK messages with the rate limit reason.