Repository navigation
feat: five runtime knobs are named, kept and shipped (ADR 0047) - #80
Merged
Merged
Conversation
kfeofantov
changed the title
ADR 0046 dropped `env` whole, and took GOMAXPROCS and GOMEMLIMIT with it — the two settings behind the most common waste in Go on Kubernetes, and stated nowhere else. The module list can show `automaxprocs` is absent; it cannot show what was set instead. - GOMAXPROCS, GOGC, GOMEMLIMIT, GODEBUG, GOTRACEBACK are kept at the same informer transform. Every other variable is still removed before the object is cached, and so are envFrom, args and command. - A name is not a promise about the value: one of the five sourced from a secretKeyRef or configMapKeyRef is dropped anyway. - One read from the container's own limits — the canonical way to tie GOMAXPROCS to a CPU limit — ships as the field path (`resource:limits.cpu`), because the spec holds no value until the kubelet resolves it. - They ship in `workload_metadata` as `runtime_env`. Keeping a field the payloads do not carry would be collection without a consumer, which ADR 0046 refuses. Negative check: keeping the allow-listed names regardless of where the value comes from fails with `kept [GOGC GOTRACEBACK GOMAXPROCS GOMEMLIMIT], want [GOMAXPROCS GOMEMLIMIT]`. Golden updated; §8 stayed at its ceiling by shedding the lines it grew. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kfeofantov
force-pushed
the
docs/what-the-agent-reports
branch
from
August 28, 2026 15:55
7295c11 to
51a8e63
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GOMAXPROCSunset under a CPU limit is the most common waste in Go onKubernetes: the runtime counts the node's cores, not the cgroup's quota, so a
container limited to half a core starts as many scheduler threads as the machine
has CPUs.
GOMEMLIMITunset under a memory limit is the second: the collectorhas no idea a ceiling exists, so the container is killed where the GC would have
run. Both are stated only in the environment, which ADR 0046 dropped whole. The
module list can show
go.uber.org/automaxprocsis absent — evidence the defaultwas not fixed, not evidence of what was set instead.
GOMAXPROCS,GOGC,GOMEMLIMIT,GODEBUG,GOTRACEBACK, kept at the sameinformer transform. Every other variable is still removed before the object is
cached, and so are
envFrom,args,command.secretKeyReforconfigMapKeyRefis dropped anyway — reading it would be aSecret read, which the agent does not do and holds no RBAC for.
(
resource:limits.cpu). That is the canonical way to tieGOMAXPROCSto alimit; the spec holds no value until the kubelet resolves it.
workload_metadataasruntime_env. Keeping a field no payloadcarries would be collection without a consumer — the outcome ADR 0046 refuses.
Negative check:
The golden covers both forms — an inline value and a downward-API one — and the
sidecar record carries no
runtime_envat all, so absence stays absent.docs/security.md§8 states the list by name and the two exclusions. The ceilingtest caught the growth: §8 went to 296 against a 290 ceiling and was brought back
by shedding a mechanism sentence about ADR 0012 and tightening the ADR 0046
bullet.
go build ./...,go test -race -count=1 ./...,make lint(0 issues),go vet -tags e2e ./...,gofmt— all green.🤖 Generated with Claude Code