Repository navigation
feat(orchestrator): Freeze queue processing while FreezeProcessing is set - #865
Merged
Merged
Conversation
manjari25
marked this pull request as ready for review
October 14, 2026 18:44
manjari25
requested review from
a team,
behinddwalls and
sbalabanov
as code owners
October 14, 2026 18:44
manjari25
force-pushed
the
manjari/queue-pause-4-freeze-gate
branch
from
October 14, 2026 19:17
884f569 to
353fc77
Compare
behinddwalls
added this pull request to stack #868
October 14, 2026 19:49
manjari25
force-pushed
the
manjari/queue-pause-4-freeze-gate
branch
from
October 14, 2026 20:50
353fc77 to
1e5a396
Compare
behinddwalls
approved these changes
Oct 15, 2026
github-merge-queue
Bot
removed this pull request from the merge queue because a pull request earlier in the stack was removed
Oct 15, 2026
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Oct 15, 2026
manjari25
force-pushed
the
manjari/queue-pause-4-freeze-gate
branch
from
October 15, 2026 22:15
1e5a396 to
2459caa
Compare
Tmwakalasya
pushed a commit
to Tmwakalasya/submitqueue
that referenced
this pull request
Oct 15, 2026
## Why? The pause RFC still presented two options as an open comparison, but the stack in uber#862 to uber#865 and the e2e tests implement one of them. An RFC describes what is on main, so it now records the design that shipped and only the alternative it rejected. ## What? - Rewrites the pause RFC around the shipped design: a separate `queuepause` extension, reject (`FailedPrecondition`, carrying the operator's reason) and freeze, both failing closed on a read error. A cancelled context is passed through. - Documents the `noop`, `file` and `fake` stores, `QUEUE_PAUSE_CONFIG_PATH`, and the shared wiring helper. - Adds the requirements an implementation of `queuepause.Store` must meet, such as failing closed on read errors, strict parsing, and failing at construction on bad configuration. - States that the gateway's own request-log consumer is not frozen, so status and history keep materializing during a freeze. - Keeps the queue-config option only as a short rejected alternative, and drops the resolved fail-open question. - Corrects the consumer gate RFC: orchestrator stages share one consumer group, and production pause is a separate mechanism that wraps the gate. Updates the RFC index entry. ## Test Plan Docs only, no runnable change. `make lint` passes. ## Issue
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why?
A paused queue needs to stop advancing accepted requests without a redeploy. The consumer gate already lets a controller be stopped and started at runtime, so freezing a queue is a gate that reads the queue's pause state.
What?
FreezeProcessingis set for a delivery's queue (its tenant), the gate is closed for every stage, including the dead-letter consumers. Blocked deliveries are postponed without spending retry budget, and released within a re-check delay of the flag being cleared. Otherwise the wrapped gate decides, soCONSUMER_GATE_DIRkeeps working.QUEUE_PAUSE_CONFIG_PATH. The store selection moves into a sharedqueuepausestorepackage that the gateway now uses too.Test Plan
bazel test //service/submitqueue/queuepausestore/... //service/submitqueue/orchestrator/serverCI
End to End tests in next PR
Issue