|
| 1 | +// Copyright (c) 2025 Uber Technologies, Inc. |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +package dlq |
| 16 | + |
| 17 | +import ( |
| 18 | + "context" |
| 19 | + "errors" |
| 20 | + "fmt" |
| 21 | + |
| 22 | + "github.com/uber-go/tally" |
| 23 | + "github.com/uber/submitqueue/platform/consumer" |
| 24 | + "github.com/uber/submitqueue/platform/metrics" |
| 25 | + stovepipemq "github.com/uber/submitqueue/stovepipe/core/messagequeue" |
| 26 | + "github.com/uber/submitqueue/stovepipe/extension/storage" |
| 27 | + "go.uber.org/zap" |
| 28 | +) |
| 29 | + |
| 30 | +// _buildSignalOpName is the metric operation name shared by every emit in this file. |
| 31 | +const _buildSignalOpName = "buildsignal_dlq" |
| 32 | + |
| 33 | +// BuildSignalController is the DLQ reconciler for the buildsignal stage. The |
| 34 | +// payload names a build, not a request, so it takes one more step than the |
| 35 | +// process reconciler: read the build to get its RequestID, then fail that |
| 36 | +// request via failRequest. |
| 37 | +// |
| 38 | +// This DLQ is the one that matters most. A request only reaches buildsignal |
| 39 | +// after process admitted it, so it holds one of the queue's in_flight_count |
| 40 | +// build slots, and buildsignal's terminal path is the only thing that gives that |
| 41 | +// slot back. Once a poll message dead-letters — a Status call that stayed broken |
| 42 | +// through every retry, an unknown build id, a storage write that kept failing — |
| 43 | +// nothing else in the pipeline will look at that build again. Without this |
| 44 | +// reconciler the request stays processing for good and the slot is never |
| 45 | +// returned, so the queue loses one slot per incident until it has none left and |
| 46 | +// stops admitting work. |
| 47 | +// |
| 48 | +// The Build row keeps whatever non-terminal status the runner last reported. |
| 49 | +// There is nothing useful to fix: record decides greenness from Request.State, |
| 50 | +// not Build.Status, and writing a terminal status here would claim we saw an |
| 51 | +// outcome we never saw. |
| 52 | +type BuildSignalController struct { |
| 53 | + logger *zap.SugaredLogger |
| 54 | + metricsScope tally.Scope |
| 55 | + stores storage.Factory |
| 56 | + topicKey consumer.TopicKey |
| 57 | + consumerGroup string |
| 58 | +} |
| 59 | + |
| 60 | +// Verify BuildSignalController implements consumer.Controller at compile time. |
| 61 | +var _ consumer.Controller = (*BuildSignalController)(nil) |
| 62 | + |
| 63 | +// NewBuildSignalController creates a DLQ controller for the buildsignal stage's |
| 64 | +// dead-letter topic. topicKey is typically |
| 65 | +// dlq.TopicKey(stovepipemq.TopicKeyBuildSignal). |
| 66 | +func NewBuildSignalController( |
| 67 | + logger *zap.SugaredLogger, |
| 68 | + scope tally.Scope, |
| 69 | + stores storage.Factory, |
| 70 | + topicKey consumer.TopicKey, |
| 71 | + consumerGroup string, |
| 72 | +) *BuildSignalController { |
| 73 | + return &BuildSignalController{ |
| 74 | + logger: logger.Named("buildsignal_dlq_controller"), |
| 75 | + metricsScope: scope.SubScope("buildsignal_dlq_controller"), |
| 76 | + stores: stores, |
| 77 | + topicKey: topicKey, |
| 78 | + consumerGroup: consumerGroup, |
| 79 | + } |
| 80 | +} |
| 81 | + |
| 82 | +// Process reconciles a single DLQ delivery for the buildsignal topic. Returns nil |
| 83 | +// to ack (success) or an error to nack (retry) — pair this controller only with a |
| 84 | +// consumer wired with errs.AlwaysRetryableProcessor so a transient reconcile |
| 85 | +// failure retries instead of dead-lettering the DLQ message itself. |
| 86 | +func (c *BuildSignalController) Process(ctx context.Context, delivery consumer.Delivery) error { |
| 87 | + msg := delivery.Message() |
| 88 | + |
| 89 | + sig := &stovepipemq.BuildSignal{} |
| 90 | + if err := stovepipemq.Unmarshal(msg.Payload, sig); err != nil { |
| 91 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "deserialize_errors", 1) |
| 92 | + // Retried rather than acked, for the same deployment-skew reason the |
| 93 | + // process reconciler gives: a newer producer's payload decodes fine once |
| 94 | + // the rollout finishes, and acking here would skip the slot release |
| 95 | + // without saying so. |
| 96 | + return fmt.Errorf("failed to decode dlq payload: %w", err) |
| 97 | + } |
| 98 | + if sig.Id == "" { |
| 99 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "empty_id_errors", 1) |
| 100 | + return fmt.Errorf("dlq payload decoded to empty build id") |
| 101 | + } |
| 102 | + |
| 103 | + store, err := c.stores.For(storage.Config{QueueName: sig.GetQueueName()}) |
| 104 | + if err != nil { |
| 105 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "storage_resolve_errors", 1) |
| 106 | + // Non-retryable: a missing or unresolvable queue is a malformed message. |
| 107 | + return fmt.Errorf("failed to resolve storage for queue %q: %w", sig.GetQueueName(), err) |
| 108 | + } |
| 109 | + |
| 110 | + dmeta := delivery.Metadata() |
| 111 | + c.logger.Warnw("dlq message received", |
| 112 | + "build_id", sig.Id, |
| 113 | + "attempt", delivery.Attempt(), |
| 114 | + "dlq_original_topic", dmeta["dlq.original_topic"], |
| 115 | + "dlq_failure_count", dmeta["dlq.failure_count"], |
| 116 | + "dlq_last_error", dmeta["dlq.last_error"], |
| 117 | + ) |
| 118 | + |
| 119 | + build, err := store.GetBuildStore().Get(ctx, sig.Id) |
| 120 | + if err != nil { |
| 121 | + if errors.Is(err, storage.ErrNotFound) { |
| 122 | + // The build row was never written — a crash between Trigger and |
| 123 | + // Create. There is no request to recover from this payload; the build |
| 124 | + // stage's own DLQ handles the request that triggered it. |
| 125 | + c.logger.Warnw("dlq reconcile: build not found, skipping", "build_id", sig.Id) |
| 126 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "build_not_found", 1) |
| 127 | + return nil |
| 128 | + } |
| 129 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "build_store_errors", 1) |
| 130 | + return fmt.Errorf("failed to get build %s: %w", sig.Id, err) |
| 131 | + } |
| 132 | + |
| 133 | + if build.RequestID == "" { |
| 134 | + // Defensive: a build with no request has nothing to reconcile and no slot |
| 135 | + // to release. Ack it so the DLQ does not grow forever. |
| 136 | + c.logger.Errorw("dlq reconcile: build has empty request id, skipping", "build_id", sig.Id) |
| 137 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "build_missing_request", 1) |
| 138 | + return nil |
| 139 | + } |
| 140 | + |
| 141 | + // Every request reachable from a build row is either still processing, and holding |
| 142 | + // the slot failRequest releases, or already terminal, and past releasing it: build |
| 143 | + // triggers only once process has written the strategy, which lands in the same CAS |
| 144 | + // as accepted→processing, and processing exits only to a terminal outcome. |
| 145 | + if err := failRequest(ctx, store, c.logger, build.RequestID); err != nil { |
| 146 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "reconcile_errors", 1) |
| 147 | + return err |
| 148 | + } |
| 149 | + |
| 150 | + metrics.NamedCounter(c.metricsScope, _buildSignalOpName, "reconciled", 1) |
| 151 | + return nil |
| 152 | +} |
| 153 | + |
| 154 | +// Name returns the controller name for logging and metrics. |
| 155 | +func (c *BuildSignalController) Name() string { |
| 156 | + return "buildsignal_dlq" |
| 157 | +} |
| 158 | + |
| 159 | +// TopicKey returns the topic key this controller subscribes to. |
| 160 | +func (c *BuildSignalController) TopicKey() consumer.TopicKey { |
| 161 | + return c.topicKey |
| 162 | +} |
| 163 | + |
| 164 | +// ConsumerGroup returns the consumer group for offset tracking. |
| 165 | +func (c *BuildSignalController) ConsumerGroup() string { |
| 166 | + return c.consumerGroup |
| 167 | +} |
0 commit comments