Operations
The deployment topology, the settings that must agree across services, and the failure modes that follow when they do not.
-
Every service in the topology, the ports it publishes, and the certificates and environment it expects.
-
The three topics, their retention and partitioning, and the per-role principal that may touch each one.
-
The six-layer precedence chain every service shares, the per-platform paths, and credential protection.
-
The tag-driven Common pipeline, the two failure modes that recur, and how consumers upgrade.
-
The short list of settings that must agree across services, and what breaks when they do not.
Start here if something is wrong
| Symptom | Look at |
|---|---|
| Every service fails at once | redpanda-init logs — it creates users, ACLs and topics, and everything else assumes it succeeded |
| Broker will not start | Certificates — there is no self-signed fallback |
| Agent connects but no events land | ACLs — the agent principal may write RawEvents only |
| Agent rejected at the fleet hub | API_KEY_HASH unset; FleetServer refuses every agent when no hashes are configured |
| Image build fails on restore | Build secrets — nuget.secrets.config missing or wrong source name |
| Process nodes carry only a PID | Invariants — carry-forward window mismatch |
| History splits at a restart | SkipIdentityRestore is on, or the changelog is disabled |
| Memory climbing on the processor | MaxTrackedIdentities set to 0, which disables the cap |
| Package publish 401s | CI — protected variable, or a V2 push URL |