Production-ready
The checklist the order status processor meets, and how it meets each item, with the page that builds it. Check your own Kafka processor against it.
The processor meets each item. Check your own processor against them:
| Item | How | Where |
|---|---|---|
| Every setting sourced and checked; a bad one exits 78, naming its variable | config.Struct and the packages’ checks | The settings |
| No secret in the environment, the logs or the spans | the client certificate, PostgreSQL’s password and the probes’ key are files read through s.Host.FS. The record’s key, an order’s ID, isn’t recorded, as queue/kafka doesn’t record it | The secrets, as files, A record’s trace |
| Certificates renewed without a restart | the Kafka client certificate is served through GetClientCertificate, and the probes’ through GetCertificate, by a small helper of the walkthrough’s own that reads their files again when they change | mTLS to Kafka |
| Concurrency within the partitions | three replicas on twelve partitions; a PodDisruptionBudget of maxUnavailable: 1 | Partitions, The disruption budget |
| Ready only once it has joined its group | Joined as readiness, on an HTTPS probes port | The probes |
| A rollout loses nothing | the revoke commits the record in flight. A record’s work fits in 15s, under the 20s grace period, and terminationGracePeriodSeconds is 30. A retried record still waiting at SIGTERM is cut short when the grace period runs out, and processed again by its partition’s next owner. The rollout case checks it | The deadline, main, The cases, in process |
| Redelivery is harmless | every event applied is kept, by its partition and offset, and skipped when it comes again | Skipping what was applied |
| No record stops it | records that are malformed or of an unknown type are dead letters at once. The rest go through orders.retry, and then to orders.dlq | Processing a record |
| An outage blocks neither topic, and keeps order | its records wait in orders.retry. An order’s later events follow its earlier ones there, since an event out of order is retried too | Retrying a record |
| Least privilege | mTLS with ACLs that let it read orders.events and orders.retry, and write orders.status, orders.retry and orders.dlq. A role with three privileges on two tables. No service account token. A non-root, read-only container | The ACLs, The schema, The Deployment |
| Observable | traces from producer to orders.status, logs and metrics over OTLP, and rules for lag, a stalled group, a crash loop, dead letters, retries, an open breaker and slow processing | Observing |
| Failures are rehearsed | the failure injection cases | The failure injection cases |
| Safe by default | no record’s scenario trusted. Only the producer to orders.retry forwards one | Trusting a topic’s scenarios, The Producers |