Build a patch ring with a health gate that refuses to promote

short · 60 min · Objective 3.1

Task

Implement staged patching across your lab with a gate that will not promote on absence of signal -- which is where automated patching usually goes wrong.

Steps

  1. Define rings in lab/rings.csv as ring,members,soak_minutes,gate, with at least three rings of increasing consequence.
  2. Write lab/promote.sh that checks the named health signals for a ring and promotes only if they are within bounds. Make ABSENCE of signal fail the gate rather than pass it.
  3. Patch ring one, run the gate, and capture the promotion decision.
  4. Break the health signal -- stop the collector, not the service -- and run the gate again. Capture the refusal in lab/gate-no-signal.txt.
  5. Record the rollback command for each ring in lab/rings.csv and test it on ring one.

Verify

awk -F, 'NR>1 {n++} END {print n" ring(s)"}' lab/rings.csv
sh lab/promote.sh ring1; echo "gate exit=$?"
grep -Eic 'no signal|missing|unknown|refus' lab/gate-no-signal.txt
awk -F, 'NR>1 && $NF=="" {n++} END {print n+0" ring(s) with no rollback"}' lab/rings.csv

Three rings, a gate that refused on ABSENT signal, and a rollback for every ring. A gate that promotes when it cannot see the signal is a gate that promotes when the monitoring has broken, which is exactly when you least want it to.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.