Container Registry and Software Supply Chain Platform  ·  View 26 of 33  ·  5 · Operations

Observability and Operations

Which signals exist, where they go, and which of them wake somebody up.

Editable source SVG draw.io All views
Emit Collect Store Consume Act Admission Verdict + reason OTel Collector Prometheus Deny reason board Page on deny spike Registry Pull and push latency OTel Collector Prometheus Pull path SLO Page on error budget Evidence Attest and replicate lag OTel Collector Prometheus Freshness board Alert on lag Scanning Queue depth and age OTel Collector Prometheus Backlog board Alert, never allow Advisory feeds Ingestion lag OTel Collector Prometheus Feed health Policy denies on age Signing and keys Cert issue + key use Fluent Bit Loki + immudb Key usage review Alert on break-glass Posture and cost Violations, bytes, scans Exporter ClickHouse Team cost report Alert over share Observability and Operations Application we own Interface / broker Data store Security / platform Count of running workloads in violation of current policy is a first-class metric, not a report. v 1.0 · owner SRE · date 2026-09

First-class metrics

  • Admission decisions by verdict and reason; policy evaluation latency
  • Scan queue depth and age; advisory feed ingestion lag; signature verification failures
  • Count of running workloads in violation of current policy — the number that says whether the platform is working

Decisions

  • The audit trail is separate from the metrics pipeline and lands in an append-only ledger independent of the registry
  • 100% of production admissions have an audit record; a missing record is a P1 incident
  • A per-artifact evidence view shows every attestation, its signer, verification result and age

Alert discipline

  • Scan backlog alerts rather than silently allowing; feed staleness becomes a policy input rather than an alert nobody acts on
  • Exception ratio above threshold alerts, because a platform running mostly on exceptions is not a control
  • Break-glass use always alerts, and the session is time-boxed
◀  Pull Path and Storm Absorption All views The Operator Loop  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 33 views · open-source, on-premises26-observability