Skip to content

11. Risks and technical debt

Risk Impact Response
PostGIS not installable (admin account not superuser, extension missing) Init Job fails, GeoServer does not start Checked first; explicit failure with exit code 3 and the command to hand over to the operator, nothing is created (sub-project 1)
DEFAULT PRIVILEGES granted to the wrong role New decoder tables invisible to GeoServer The script reads the schema owner; re-running grant-reader catches up on existing objects (sub-project 1)
Pre-existing cluster-level geoserver role, created by another account ALTER ROLE refused (PostgreSQL 16+: only the creator or a superuser may modify it) Explicit PostgreSQL error; convention: the role is created by the init Job with the provided admin account (sub-project 1)
Password rotation not propagated GeoServer loses its connection after rotation Procedure: Secret → Job → GeoServer restart; JNDI pool read at startup (sub-project 2)
Loss of the catalog encryption key Store passwords undecryptable, catalog unusable Covered: security/ (master key, keystore) carried in the database by JDBCStore, identical for all replicas (sub-project 2, ADR-0005); the database backup includes the key
Divergence between database and disk Inconsistent behavior across replicas Covered: ephemeral data dir regenerated, no durable write to disk (sub-project 2)
Configuration made through REST/UI not persisted or not propagated Lost on restart, divergent replicas Covered: configuration through the GeoServerInitializer plugin (ADR-0006); REST reserved for manual operations
GeoServer admin password rotation GEOSERVER_ADMIN_PASSWORD is only imported at first boot Covered: PUT /rest/security/self/password on one node, effective on all (sub-project 3, test 07) — to be integrated into the operations procedure
Problem while reinitializing Logging from JDBC Config message on subsequent boots Logging possibly left at the default level Observed as non-blocking; to be qualified (sub-project 3)
Clustering blocked at startup Replicas unavailable Covered: DNS discovery without RBAC, pre-check and explicit stop within 3 s (sub-project 3, test 04)
RWX storage unavailable on the target platform Asynchronous WPS results unreadable from the other nodes Documented platform requirement (ch. 7.2); fallback: disable result storage
Loss of the node holding a UI session (affinity) User logged out Acceptable for an administration UI; HZ_SESSION_SHARING=true validated if needed
Keystore password (master key) left at its default Warning in the UI; secrets encrypted with a known key To address: change via PUT /rest/security/masterpw (or the UI) after the first boot, persisted in the database by JDBCStore; to be integrated into the initialization plugin or the operations procedure (sub-project 4 or later)
S3 tile cache without an expiration policy Unbounded bucket growth To define: retention by prefix/age on the S3 side, or GWC seeding/truncation (out of scope for sub-project 4)
Granule retention (S3 + index) undefined Unbounded growth To define together with the retention policy (per quantity/model); consistent S3 + index deletion by the ingestion service
Observation retention (hypertable) not defined Unbounded table growth To be defined with the data owners (TimescaleDB drop_chunks policy) — sub-project 6
Retention decision ownership unclear Policies cannot be committed Open: identify who owns data-lifetime decisions (per family) before implementing any purge
Request-time raster palettes not implemented Client requirement (2026-09-02) unmet Future work: named styles per palette and/or env()-parameterized ColorMaps
Validity-interval time dimension (AIRMET/SIGMET/GAMET, TAF) not modelled Area messages cannot be time-navigated yet Future work: interval-based TIME (start/end attributes) on vector layers
Cascaded basemap provider unavailable or terms changed Background layer degraded Optional by design (ConfigMap), hosted basemap is the default; S3 cache keeps recent tiles
Dependency on public repositories (SourceForge, OSGeo Nexus) to build the image Build impossible if an artifact is withdrawn Corporate artifact repository (ADR-0007, proposed)