fix(security): verify workload DB concurrency budget

scripts/ops/awoooi-workload-db-identity-bootstrap.sh

@@ -61,8 +61,18 @@ workload_secret() {
 
 workload_connection_limit() {
   case "$1" in
-    api) printf '4' ;;
-    worker|broker) printf '2' ;;
+    api) printf '12' ;;
+    worker) printf '8' ;;
+    broker) printf '4' ;;
+    *) return 1 ;;
+  esac
+}
+
+workload_required_connection_budget() {
+  case "$1" in
+    api) printf '8' ;;
+    worker) printf '5' ;;
+    broker) printf '2' ;;
     *) return 1 ;;
   esac
 }
@@ -211,6 +221,7 @@ preflight_workload() {
   workload="$1"
   secret="$2"
   connection_limit="$3"
+  required_connection_budget="$4"
   deployment_spec="$(workload_deployment "$workload")"
   deployment="${deployment_spec%%|*}"
   container="${deployment_spec#*|}"
@@ -251,6 +262,8 @@ spec:
               key: DATABASE_URL
         - name: EXPECTED_CONNECTION_LIMIT
           value: "${connection_limit}"
+        - name: REQUIRED_CONCURRENT_CONNECTIONS
+          value: "${required_connection_budget}"
         - name: WORKLOAD_ID
           value: "${workload}"
       command: ["python", "-c"]
@@ -320,6 +333,19 @@ spec:
                                   AND NOT has_sequence_privilege(current_user, sequence.oid, 'UPDATE'))
                             )
                       """))).scalar_one())
+
+                  required_concurrency = int(
+                      os.environ["REQUIRED_CONCURRENT_CONNECTIONS"]
+                  )
+
+                  async def probe_connection() -> None:
+                      async with engine.connect() as probe:
+                          await probe.execute(text("SELECT pg_sleep(0.25)"))
+
+                  await asyncio.gather(*(
+                      probe_connection()
+                      for _ in range(required_concurrency)
+                  ))
               finally:
                   await engine.dispose()
 
@@ -336,6 +362,7 @@ spec:
                       str(identity["role_name"]).encode("utf-8")
                   ).hexdigest(),
                   "connection_limit": observed_limit,
+                  "concurrent_connection_probe_count": required_concurrency,
                   "representative_read_count": 3,
                   "table_privilege_gap_count": table_gap_count,
                   "sequence_privilege_gap_count": sequence_gap_count,
@@ -410,6 +437,7 @@ for workload in "${selected_workloads[@]}"; do
   role="$(workload_role "$workload")"
   secret="$(workload_secret "$workload")"
   connection_limit="$(workload_connection_limit "$workload")"
+  required_connection_budget="$(workload_required_connection_budget "$workload")"
   secret_present=false
   if kube get secret "$secret" -n "$NAMESPACE" >/dev/null 2>&1; then
     secret_present=true
@@ -443,10 +471,11 @@ for workload in "${selected_workloads[@]}"; do
   else
     ready=false
   fi
-  echo "workload=$workload secret_ref=$secret secret_present=$secret_present role_present=$role_present contract_ready=$state_ready connection_limit=$connection_limit"
+  echo "workload=$workload secret_ref=$secret secret_present=$secret_present role_present=$role_present contract_ready=$state_ready connection_limit=$connection_limit required_connection_budget=$required_connection_budget"
 
   if [ "$MODE" = "apply" ] || [ "$MODE" = "verify" ]; then
-    preflight_workload "$workload" "$secret" "$connection_limit"
+    preflight_workload "$workload" "$secret" "$connection_limit" \
+      "$required_connection_budget"
   fi
 done