Repository navigation
feat: join node facts into a go_inventory payload (ADR 0010) - #23
Merged
Merged
Conversation
…erage counters (ADR 0010) Turns the received node build-info facts into a shippable payload. - PodWatcher gains a container-ID index and LookupContainer(podUID, containerID) → (namespace, workload, container, imageDigest): the join key the node facts need. Container IDs are normalized to the bare lowercase hex the node parses from the cgroup, so cgroupfs and systemd-driver shapes both match. - internal/inventory joins facts against that lookup into one GoRecord per (namespace, workload, container): Go version, module path, image digest, PGO. Replicas and nodes running the same build collapse to one record; a fact whose pod/container cannot be resolved is counted unjoined and dropped, never guessed. State is in memory only (loss-harmless, ADR 0003). - sink.WriteGoInventory writes a new "go_inventory" payload as one superseding batch (upsert-by-key, like a usage snapshot), with a golden file. - The controller's receiver callback now ingests each report; the coverage log gains aggregate inventory counters (records, distinct Go versions, PGO builds, facts received/joined/unjoined — no identity of an unjoined fact, invariant 6); the inventory flushes to the spool on the coverage cadence and once on shutdown. security.md §8 documents the join and the go_inventory payload as medium- sensitivity workload metadata; unjoined facts leave only as a count. Tests: inventory join (attribute, unjoined, replica dedup, rollout latest-wins, distinct-version/PGO counters, sorted snapshot); PodWatcher LookupContainer and container-ID normalization; sink golden and supersede. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Slice 3b: turn the received node build-info facts into a shippable payload. The full-path e2e lands in slice 4.
Join
PodWatcher.LookupContainer(podUID, containerID)→(namespace, workload, container, imageDigest), backed by a new container-ID index. IDs are normalized to the bare lowercase hex the node parses from the cgroup, so cgroupfs and systemd-driver shapes both match.internal/inventoryjoins facts → oneGoRecordper(namespace, workload, container): Go version, module path, image digest, PGO. Replicas/nodes running the same build collapse to one record; an unresolvable fact is counted unjoined and dropped, never guessed. In-memory only (loss-harmless, ADR 0003).Payload
sink.WriteGoInventorywrites a new"go_inventory"payload as one superseding batch (upsert-by-key, like a usage snapshot) — with a golden file.Wiring
security.md
§8 documents the join and the
go_inventorypayload as medium-sensitivity workload metadata; unjoined facts leave only as a count.Tests
Inventory join (attribute, unjoined, replica dedup, rollout latest-wins, distinct-version/PGO counters, sorted snapshot);
LookupContainer+ container-ID normalization; sink golden + supersede.e2e
No manifest change here; the deployable surface is unchanged. The full DaemonSet → controller → spool path is asserted in slice 4.
🤖 Generated with Claude Code