Skip to content

chore(infra): newest stable infra images, drop kafka-ui, bound CI caches (S8) - #66

Merged
patterncatalyst merged 12 commits into
mainfrom
chore/infra-images
Oct 11, 2026
Merged

patterncatalyst merged 12 commits into
mainfrom
chore/infra-images

Conversation

@patterncatalyst

Copy link
Copy Markdown
Owner

S8 of the modernization plan (_plans/modernization-plan.md).

Images (fully qualified, newest stable, verified with skopeo)

  • apache/kafka 4.3.1, postgres 18.6-alpine (volume at /var/lib/postgresql), redis 8.10.2-alpine (AGPLv3 option), quay.io/debezium/connect 3.7.0.Final, apicurio-registry 3.3.3, flagd v0.17.0, otel-lgtm 0.36.0, envoy v1.39.3
  • kafka-ui removed; docs point to kcat / kafka-console-consumer.sh
  • Test tools pinned: newman 6.2.3, htmlextra 1.23.1, hey v0.1.5, ghz v0.121.0 (checksum-verified), conftest 0.71.1

Breaking changes handled

  • Debezium 3.7 OOM at 1 GB: 2g limit, Xmx1G
  • Apicurio 3.3: health on management port 9000 (host 19000); incompatible schema returns 400 RuleViolationException
  • Tempo 3: search needs a time window; 11 verify filters by service
  • otel-lgtm 0.36: our datasources file now overrides the bundled one

CI caches (12.4 GB, over the 10 GB quota)

  • Only main writes caches; PRs restore only
  • Maven and Go: one shared key each, warmed by main-only warm-maven / warm-go jobs with guarded eviction
  • Conan: pruned to packages only; builder stage forced on a main miss so an empty cache can never be saved
  • cache-cleanup.yml deletes a closed PR's caches
  • Estimated steady state ~3.7 GB, bound ~4.9 GB

Evidence

  • Full matrix 111/111 PASS; Opus validation + 2 repair rounds; 11-target and 8-target reruns PASS
  • actionlint clean; validate_site.py 0 errors

Kafka 4.3.1, Postgres 18.6 (volume at /var/lib/postgresql), Redis 8.10.2,
Debezium 3.7.0 from quay.io (2 GB limit, heap capped), Apicurio 3.3.3 (health on
the management port 9000), flagd v0.17.0, otel-lgtm 0.36.0, Envoy v1.39.3.
Fully qualified image names throughout; the LGTM datasource file now replaces the
image's grafana-datasources.yaml instead of sitting beside it.
kafka-ui is gone from the compose files and READMEs (kcat or
kafka-console-consumer.sh inside the kafka container replace it). Apicurio 3.3
answers 400 to an incompatible schema (was 409) and serves health on 19000;
example 11 searches Tempo with a time window and retries while it indexes.
newman 6.2.3 with newman-reporter-htmlextra 1.23.1, ghz v0.121.0 (pinned
download), hey v0.1.5, conftest 0.71.1 (all re-verified as the newest stable).
PR runs restore Maven, Go, Conan and BuildKit caches but never write them.
On main the Conan cache mount is pruned of build trees, sources and downloads
(1.6 GB -> 163 MB measured) before it is extracted and saved. A cleanup
workflow drops a closed PR's caches.
…n a miss

Maven and Go use one shared key each, written by main-only warm jobs that
resolve every project. On a main Conan miss the builder stage bypasses the
layer cache so the cache mount is populated, and the prune step fails when no
built package is left. Pin the buildkit-cache-dance utility image.
09 requires RuleViolationException with the 400 and a count of exactly 2;
11 searches Tempo for the order-service.
@patterncatalyst
patterncatalyst merged commit e749a40 into main Oct 11, 2026
198 checks passed
@patterncatalyst
patterncatalyst deleted the chore/infra-images branch October 11, 2026 07:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant