Observability Platform  ·  View 09 of 25  ·  Structure

Collection Tier

The node agent, the gateway that admits, and the untrusted edge that uses the same door.

Editable source SVG draw.io All views
AWS eu-west-1 — EKS data plane Workload node (× 12,000) Application pod OTel SDK, no buffer ADOT node agent ≤ 2% core, ≤ 350 MB Bounded local spool sheds by class Host & container metrics no app cooperation Gateway namespace — the admission point Network Load Balancer OTLP/gRPC Normalise units, names, clock source Redact before any write Cardinality admission drop label, then reject Path split aggregate ǀ select Trace affinity tier Load-balancing exporter shard by trace id Tail sampler shard holds whole traces Everything not on EKS EC2 and managed services EC2 agent systemd unit CloudWatch metric streams RDS, MSK, NLB Untrusted ingest — its own trust zone WAF + API Gateway rate limited per key Client telemetry receiver attribute allow-list EKS Pod Identity / IAM Roles Anywhere Ingest buffer (MSK) OTLP/gRPC evidence aggregated kept traces workload identity Collection Tier — Agent, Gateway and the Untrusted Edge Application we own Security / platform Queue / topic Interface / broker Decision point synchronous event / async The application never holds a durable buffer and never retries to a remote endpoint. The untrusted client receiver reaches the same gateway as everything else, but through its own keyed, rate-limited path and never as a service identity. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • The application never holds a durable buffer and never retries to a remote endpoint. The node agent's bounded spool is the only queue in front of the gateway, and it sheds by class rather than growing.
  • Resource identity is applied by the collection tier from scheduling metadata and from the credential the workload proved — never trusted from the payload (view 24).
  • Tail sampling needs trace affinity, so the gateway exports through a consistent hash on trace id before the sampler sees anything.

Numbers

  • Node agent ≤ 2% of one core and ≤ 350 MB RSS at steady state; in-process exporter ≤ 1% and ≤ 60 MB. The agent sheds its own telemetry before exceeding these and reports having done so.
  • Gateway admission enforces 250,000 active series per service by default, 2 M by expiring exception, and a 100-value ceiling per label.

Risks

  • The gateway is now doing normalisation, redaction, admission, aggregation and path splitting. It is the busiest component in the platform and the one whose failure is hardest to degrade gracefully.
  • The untrusted client path shares the gateway. Its rate limits and attribute allow-list are the only thing between a hostile client and the platform's ingest budget.
◀  The Completeness Boundary All views Platform Services  ▶
Solution Architecture v1.0 · Amazon Web Services with open-source collection and storage · Reliability Architecture · 2026-09 · 25 views09-collection-tier