Usage Metering & Billing Pipeline · View 16 of 22 · Operations
Decisions
- Single-region active with a cross-region ledger replica. An accepted event survives the loss of a region; the control plane is restored from the replica rather than run hot, because active-active ingestion needs a deduplication story that spans regions and that is Phase 3.
- Compute is zone-redundant and stateless; all state is in zone-redundant managed services, so an AZ loss costs capacity and not correctness.
- The invoice and restatement runs are orchestrated rather than deployed as services, because they are periodic and must be resumable, which is a workflow property rather than a serving one.
Assumptions
- RTO 15 minutes for ingestion and 4 hours for the invoice run; RPO 0 for acknowledged events (stated assumptions).
- Producer-side buffers hold long enough to cover a 15-minute ingestion outage, which is what makes RPO 0 meaningful rather than aspirational.
Risks
- A regional outage longer than producer buffer depth is unbilled usage. This is the accepted cost of not running active-active, and it should be stated to the business in those words.
- Flink task managers across three zones means cross-zone traffic on every shuffle; at 250,000 events/s that is a real line on the bill, and it is why cost-per-million-events is watched.
