| PostGIS not installable (admin account not superuser, extension missing) |
Init Job fails, GeoServer does not start |
Checked first; explicit failure with exit code 3 and the command to hand over to the operator, nothing is created (sub-project 1) |
DEFAULT PRIVILEGES granted to the wrong role |
New decoder tables invisible to GeoServer |
The script reads the schema owner; re-running grant-reader catches up on existing objects (sub-project 1) |
Pre-existing cluster-level geoserver role, created by another account |
ALTER ROLE refused (PostgreSQL 16+: only the creator or a superuser may modify it) |
Explicit PostgreSQL error; convention: the role is created by the init Job with the provided admin account (sub-project 1) |
| Password rotation not propagated |
GeoServer loses its connection after rotation |
Procedure: Secret → Job → GeoServer restart; JNDI pool read at startup (sub-project 2) |
| Loss of the catalog encryption key |
Store passwords undecryptable, catalog unusable |
Covered: security/ (master key, keystore) carried in the database by JDBCStore, identical for all replicas (sub-project 2, ADR-0005); the database backup includes the key |
| Divergence between database and disk |
Inconsistent behavior across replicas |
Covered: ephemeral data dir regenerated, no durable write to disk (sub-project 2) |
| Configuration made through REST/UI not persisted or not propagated |
Lost on restart, divergent replicas |
Covered: configuration through the GeoServerInitializer plugin (ADR-0006); REST reserved for manual operations |
| GeoServer admin password rotation |
GEOSERVER_ADMIN_PASSWORD is only imported at first boot |
Covered: PUT /rest/security/self/password on one node, effective on all (sub-project 3, test 07) — to be integrated into the operations procedure |
Problem while reinitializing Logging from JDBC Config message on subsequent boots |
Logging possibly left at the default level |
Observed as non-blocking; to be qualified (sub-project 3) |
| Clustering blocked at startup |
Replicas unavailable |
Covered: DNS discovery without RBAC, pre-check and explicit stop within 3 s (sub-project 3, test 04) |
| RWX storage unavailable on the target platform |
Asynchronous WPS results unreadable from the other nodes |
Documented platform requirement (ch. 7.2); fallback: disable result storage |
| Loss of the node holding a UI session (affinity) |
User logged out |
Acceptable for an administration UI; HZ_SESSION_SHARING=true validated if needed |
| Keystore password (master key) left at its default |
Warning in the UI; secrets encrypted with a known key |
To address: change via PUT /rest/security/masterpw (or the UI) after the first boot, persisted in the database by JDBCStore; to be integrated into the initialization plugin or the operations procedure (sub-project 4 or later) |
| S3 tile cache without an expiration policy |
Unbounded bucket growth |
To define: retention by prefix/age on the S3 side, or GWC seeding/truncation (out of scope for sub-project 4) |
| Granule retention (S3 + index) undefined |
Unbounded growth |
To define together with the retention policy (per quantity/model); consistent S3 + index deletion by the ingestion service |
| Observation retention (hypertable) not defined |
Unbounded table growth |
To be defined with the data owners (TimescaleDB drop_chunks policy) — sub-project 6 |
| Retention decision ownership unclear |
Policies cannot be committed |
Open: identify who owns data-lifetime decisions (per family) before implementing any purge |
| Request-time raster palettes not implemented |
Client requirement (2026-09-02) unmet |
Future work: named styles per palette and/or env()-parameterized ColorMaps |
| Validity-interval time dimension (AIRMET/SIGMET/GAMET, TAF) not modelled |
Area messages cannot be time-navigated yet |
Future work: interval-based TIME (start/end attributes) on vector layers |
| Cascaded basemap provider unavailable or terms changed |
Background layer degraded |
Optional by design (ConfigMap), hosted basemap is the default; S3 cache keeps recent tiles |
| Dependency on public repositories (SourceForge, OSGeo Nexus) to build the image |
Build impossible if an artifact is withdrawn |
Corporate artifact repository (ADR-0007, proposed) |