From a5184e5ba15203c748053e579a5e1fb6f92bc671 Mon Sep 17 00:00:00 2001 From: Paulo Sousa Date: Sun, 31 May 2026 19:39:59 +0100 Subject: [PATCH] oss-standalone-redisearch-m5: port parca-agent config from m7 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The m5 cloud-init only set `remote-store-bearer-token`; with a `psc_v1__` token (no project id embedded in the JWT claims), parca-agent v0.47+ silently drops profiles unless a `--remote-store-grpc-headers=projectID=` is also set. That is why redislabsdev/RediSearch benchmark dispatches against this setup produce 0 profile samples in the redisearch Polar Signals project. This change makes m5 match the m7 module: * Add `parca_agent_project_id` and `parca_agent_snap_channel` vars (defaults preserve current behaviour: empty project id, `stable` channel — so existing callers passing only the token still work). * Thread the new vars through the `templatefile` call. * Rewrite the cloud-init to mirror m7: relabel_configs file pinning to `redis-server` and promoting thread/pid labels, plus the `remote-store-grpc-headers=projectID=...` snap setting and the channel pin. Result: oss-standalone dispatches with `enable_parca_agent=true` and a `psc_v1_*` token will emit profiles to the configured Polar Signals project, with `test_name`/`git_hash`/etc labels. Co-Authored-By: Claude Opus 4.7 --- .../cloud-init-parca-agent.yaml | 65 ++++++++++++++++++- .../db-resources.tf | 4 +- .../oss-standalone-redisearch-m5/variables.tf | 24 +++++++ 3 files changed, 89 insertions(+), 4 deletions(-) diff --git a/terraform/oss-standalone-redisearch-m5/cloud-init-parca-agent.yaml b/terraform/oss-standalone-redisearch-m5/cloud-init-parca-agent.yaml index d964d13..54ad5f1 100644 --- a/terraform/oss-standalone-redisearch-m5/cloud-init-parca-agent.yaml +++ b/terraform/oss-standalone-redisearch-m5/cloud-init-parca-agent.yaml @@ -1,13 +1,72 @@ #cloud-config -# Parca agent configuration +# Server-side relabel config for parca-agent, mirrored from the +# /etc/parca-agent.yml convention used on the Redis OSS benchmark runners: +# * drop every sample whose executable is not redis-server so Polar +# Signals storage/quota is spent on the module we actually profile +# (RediSearch code runs inside the redis-server process) +# * promote __meta_thread_id / thread_comm / process_pid to first-class +# labels so queries can filter by thread or pid +# * default role=primary, override to replica when `replicaof` is in the +# process cmdline +write_files: + - path: /etc/parca-agent.yml + permissions: '0644' + owner: root:root + content: | + relabel_configs: + - source_labels: [__meta_thread_id] + target_label: thread_id + + - source_labels: [__meta_thread_comm] + target_label: thread_name + + - source_labels: [__meta_process_pid] + target_label: pid + + # Drop everything that is NOT redis-server. + - source_labels: [__meta_process_executable_name] + regex: "^redis-server$" + action: keep + + # Default: mark as primary. + - target_label: role + replacement: primary + action: replace + + # Override: mark as replica if "replicaof" appears in cmdline. + - source_labels: [__meta_process_cmdline] + regex: '.*replicaof.*' + target_label: role + replacement: replica + action: replace + +# Parca agent install + wire the config. +# +# Channel: +# `stable` -> v0.46.0, works with JWT tokens that embed `projectId`. +# `edge` -> v0.47.1+, required when the token is `psc_v1__` +# (no project binding in the token -- v0.46.0 does not honor +# the projectID gRPC header in that case). +# +# GRPC headers: +# When `parca_agent_project_id` is set, parca-agent is told to route writes +# to that project via `--remote-store-grpc-headers=projectID=` (this is +# exactly how Polar Signals' own k8s `manifests.yaml` wires the DaemonSet). +# Leave the project id empty when using a JWT token that already carries +# the project id in its claims. snap: commands: - - [install, parca-agent, --classic] + - [install, parca-agent, --classic, --channel=${parca_agent_snap_channel}] + - [set, parca-agent, config-path=/etc/parca-agent.yml] - [ set, parca-agent, remote-store-bearer-token=${parca_agent_token}, ] + - [ + set, + parca-agent, + remote-store-grpc-headers=projectID=${parca_agent_project_id}, + ] - [start, --enable, parca-agent] - diff --git a/terraform/oss-standalone-redisearch-m5/db-resources.tf b/terraform/oss-standalone-redisearch-m5/db-resources.tf index 7029596..d670036 100644 --- a/terraform/oss-standalone-redisearch-m5/db-resources.tf +++ b/terraform/oss-standalone-redisearch-m5/db-resources.tf @@ -54,7 +54,9 @@ team = "performance a&o" # Polar Signals Parca agent configuration (optional) ################################################################################ user_data = var.enable_parca_agent ? templatefile("${path.module}/cloud-init-parca-agent.yaml", { - parca_agent_token = var.parca_agent_token + parca_agent_token = var.parca_agent_token + parca_agent_project_id = var.parca_agent_project_id + parca_agent_snap_channel = var.parca_agent_snap_channel }) : null ################################################################################ diff --git a/terraform/oss-standalone-redisearch-m5/variables.tf b/terraform/oss-standalone-redisearch-m5/variables.tf index 460b141..7f73ed3 100644 --- a/terraform/oss-standalone-redisearch-m5/variables.tf +++ b/terraform/oss-standalone-redisearch-m5/variables.tf @@ -193,3 +193,27 @@ variable "parca_agent_token" { default = "" sensitive = true } + +variable "parca_agent_project_id" { + description = <<-EOT + Polar Signals project id. Required when parca_agent_token is a + `psc_v1__` (no project binding in the + token) -- passed to parca-agent as `--remote-store-grpc-headers=projectID=` + so the server can route writes to the right project. Leave empty + when parca_agent_token is a JWT (`eyJ...`) with `projectId` already + embedded in its claims. + EOT + type = string + default = "" +} + +variable "parca_agent_snap_channel" { + description = <<-EOT + Snap channel for parca-agent. v0.46.0 (stable) does not honor the + projectID gRPC header with `psc_v1_` tokens; use `edge` (v0.47.1+) + for that workflow. Safe to leave as `stable` when using a JWT token + with the project id embedded. + EOT + type = string + default = "stable" +}