feat(foundry): deploy the p987 telemetry ingest service - #166
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b539a6f69b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| upstream: p987 | ||
| rewrite: | ||
| strip_prefix: /api | ||
| envelope: default |
There was a problem hiding this comment.
When clients connect to /api/p987/live, this catch-all applies the default response envelope, which interferes with the WebSocket upgrade and leaves the new service's live endpoint unusable through Kerbecs. The equivalent /api/gr26/live route is explicitly configured as passthrough; add a specific p987 live passthrough route before this catch-all.
Useful? React with 👍 / 👎.
TCM-987 publishes under the p987 topic namespace and nothing in the cluster consumed it. Adds the ingest service alongside gr26. Narrower than gr26: live path only, so no foreman worker pool and no shelter cold-storage ingest, which means no FOREMAN_ENDPOINT and no AWS credentials. It subscribes, decodes, writes ClickHouse and republishes to query/live/*. MQTT uses a shared subscription so frames split across replicas rather than each replica writing the same row. Pinned to :latest with imagePullPolicy Always because p987 merged after v3.9.9 and has no release tag yet. The mapache deploy workflow now includes p987 in its tag-bump list, so the next services release replaces this with a real version. Reuses the existing mapache-secrets keys, so no new VaultSecretSync and no new Vault access rule. Added to rolloutTargets so it restarts on rotation.
b539a6f to
4d6ff77
Compare
2 participants
manifests/mapache/p987.yaml— Deployment (2 replicas, same topology spread as gr26) + Service on 7020p987.yamlin the kustomization and pin the imagep987upstream and/api/p987/*route to the kerbecs configmapp987tomapache-secretsrolloutTargets so it restarts on rotationConsumes the
p987/#MQTT namespace that TCM-987 publishes to, which nothing in the cluster was reading. Narrower than gr26 — live path only, so no foreman worker pool and no shelter cold-storage ingest, and therefore noFOREMAN_ENDPOINTand no AWS credentials. MQTT uses a shared subscription ($share/p987-cluster/p987/#) so frames split across replicas instead of each replica writing the same row.No manual steps required. It reuses existing
mapache-secretskeys (CLICKHOUSE_*,KERBECS_PASSWORD,MQTT_*), so there's no newVaultSecretSyncand no new Vault access rule to create. Thep987_cantable is created by the service on first ClickHouse connect, same asgr26_can.On the image tag: pinned to
:latestwithimagePullPolicy: Alwaysbecause p987 merged after v3.9.9 and has no release tag yet. Gaucho-Racing/Mapache#227 adds p987 to the deploy workflow's tag-bump allowlist, so the next services release rewrites this to a real version — merge that one first or this pin will never move.kustomize buildverified locally.gr-foundry only.
kubernetes/gr-prod/is still pinned at 3.9.6 and there's no EKS left ininfra/environments/prod, so I treated it as dormant and left it alone — say the word if it should be mirrored there too.