fix(noderesource): raise cosmos-exporter memory ceiling 384Mi -> 512Mi (stopgap)#497
fix(noderesource): raise cosmos-exporter memory ceiling 384Mi -> 512Mi (stopgap)#497bdchatham wants to merge 1 commit into
Conversation
…i (stopgap) cosmos-exporter sidecars are OOMKilling roughly every ~2h fleet-wide (observed on atlantic-2/archive-0-0-0: 7 restarts over 14h). Root cause is believed to be a memory leak in the goroutine-per-event fan-out in HandleBankTransferEvent (sei-cosmos-exporter/events.go) -- NOT the eventstream Reset()/Run() reconnect path, which was independently verified to have no leak (single in-flight goroutine at all times, clean handoff). This raises the OOM ceiling as a stopgap to reduce restart frequency while the upstream leak gets fixed -- it does not fix the leak. Filed as a follow-up: [upstream sei-cosmos-exporter issue to be filed]. Reaches every live SeiNode on its next controller reconcile (the StatefulSet template is re-rendered unconditionally each pass, independent of the image-drift gate that controls automatic pod replacement) -- a pod that isn't automatically rolled (no image drift) picks up the new limit on its next natural recreation (its own OOM-restart cycle, or a manual `kubectl delete pod`). Cross-reviewed via /xreview: idiom pass confirmed this matches the file's existing comment/resource-quantity conventions; a controller-boundary review confirmed the rollout-trigger mechanism (template re-renders every reconcile; only automatic pod-replace is image-drift-gated) and corrected an earlier assumption that this specific stopgap couldn't reach Git-detached SeiNode CRs -- it does, since the controller reconciles off the live CR, not off Git. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
PR SummaryLow Risk Overview Comments in code document that this does not fix the leak—it should reduce restart frequency until an upstream fix. Reviewed by Cursor Bugbot for commit 329dd20. Bugbot is set up for automated code reviews on this repo. Configure here. |
Summary
cosmos-exportersidecars are OOMKilling roughly every ~2h fleet-wide (observed onatlantic-2/archive-0-0-0: 7 restarts over 14h). This raises the hardcoded memory limit indefaultCosmosExporterResources()from 384Mi to 512Mi as a stopgap to reduce restart frequency — it does not fix the underlying leak.Root cause
Investigated as part of a broader NodeSystemSaturation remediation (unrelated node/incident, cosmos-exporter surfaced as a side finding). Root cause is believed to be the goroutine-per-event fan-out in
HandleBankTransferEvent(sei-cosmos-exporter/events.go) — every qualifying transfer unconditionally spawns a goroutine with a 5-minutetime.Sleepbefore deleting its metric label, so under a rising event-rate burst, live goroutines scale with (event rate × 300s), outrunning the drain and climbing toward OOM. An/xreviewsystems-engineering pass specifically ruled out the originally-suspected culprit — theeventStream.Reset()/Run()reconnect path — after reading the actual code: it's synchronous, single-goroutine, with a clean handoff onMissedItemsError; no leak there.Follow-up needed: file the leak issue against
sei-cosmos-exporter(not this repo) pointing at the goroutine-per-event fan-out, not the reconnect path.Why this reaches every live node, not just image-drift-triggered ones
An
/xreviewcontroller-boundary pass corrected an earlier assumption in this investigation: the StatefulSet template is re-rendered and re-applied via SSA on every controller reconcile pass, completely independent of the image-drift gate — that gate only controls whether the running pod gets force-replaced. So:kubectl delete pod(safe underOnDelete: recreated pods reflect the current template, not a frozen one).atlantic-2/archive-0-0-0currently) — the controller reconciles off the live CR object, not off Git, so Git-detachment doesn't block this specific fix.Blast radius
Applies fleet-wide (cosmos-exporter is added unconditionally to every SeiNode/mode). Only the
limits.memorymoves;requestsare unchanged (64Mi), so there's no scheduling/bin-packing impact. Runtime risk: the leak means every exporter trends toward its limit, so the request:limit ratio widens from 6x to 8x — worth a capacity sign-off on nodes co-hosting multiple memory-heavy exporters, flagged here rather than blocking this PR on it.Test plan
go build ./internal/noderesource/...passesgo test ./internal/noderesource/...passes (updatedTestCosmosExporter_DefaultResourcesto expect 512Mi)sei-cosmos-exporterleak issue (goroutine-per-event fan-out inHandleBankTransferEvent)🤖 Generated with Claude Code