Session ses_34a139cd

{"headRefName":"byk/orbital-gocd-pipeline","number":19386,"title":"feat(orbital): add GoCD deploy pipeline for orbital-k8s","url":"https://github.com/getsentry/ops/pull/19386"}

[{"link":"https://github.com/getsentry/ops/actions/runs/22506996032/job/65208309594","name":"tacos-gha / summary","state":"SUCCESS"},{"link":"https://github.com/getsentry/ops/actions/runs/22506996032/job/65208031210","name":"tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/iam/binding_project_non_authoritative/us)","state":"SUCCESS"},{"link":"https://github.com/getsentry/ops/actions/runs/22506996032/job/65208031180","name":"tacos-gha / TACOS Plan (terraform/internal-sentry/gke)","state":"SUCCESS"},{"link":"https://github.com/getsentry/ops/actions/runs/22506996032/job/65208031194","name":"tacos-gha / TACOS Plan (terraform/sentryio/iam)","state":"SUCCESS"},{"link":"https://github.com/getsentry/ops/actions/runs/22506996032/job/65208031184","name":"tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)","state":"FAILURE"},{"link":"https://github.com/getsentry/ops/actions/runs/22506996032/job/65208031197","name":"tacos-gha / TACOS Plan ...

tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:58:30.2392870Z + tee ./matrix-fan-out/matrix.list
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:58:30.2402909Z tf-root-module=terragrunt/regions/multi-tenant/gke-main-cluster/s4s2
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:58:30.2404269Z + : Calculate artifact name
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:58:30.2405856Z + /home/runner/work/ops/ops/./tacos-gha/.github/actions/matrix-fan-out/set-artifact-name.sh './matrix-fan-out/(tf-root-module=terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)'
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:58:30.2422612Z + : Calculate artifact name
tacos-gha / TACOS Plan ...

tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:43.8434571Z Current runner version: '2.331.0'
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:43.8471029Z ##[group]Runner Image Provisioner
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:43.8472129Z Hosted Compute Agent
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:43.8472999Z Version: 20260213.493
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:43.8473818Z Commit: 5c115507f6dd24b8de37d8bbe0bb4509d0cc0fa3
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:43.8474834Z Build Date: 2026-02-13T00:28:41Z
tacos-gha / TACOS Plan ...

tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:49.5165012Z shell: /usr/bin/bash -euxo pipefail {0}
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:51.0370209Z   "fail-fast": false,
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:51.1764076Z direnv: export +MAKEFLAGS +NPROC +PS1_PREFIX +PYTHONPATH +PYTHONSAFEPATH +TERRAGRUNT_FAIL_ON_STATE_BUCKET_CREATION +TERRAGRUNT_INCLUDE_MODULE_PREFIX +TERRAGRUNT_NO_AUTO_INIT +TERRAGRUNT_NO_AUTO_RETRY +TF_CLI_ARGS_plan +VIRTUAL_ENV ~PATH
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-02-27T22:57:51.2943980Z direnv: export +MAKEFLAGS +NPROC +PS1_PREFIX +PYTHONPATH +PYTHONSAFEPATH +TERRAGRUNT_FAIL_ON_STATE_BUCKET_CREATION +TERRAGRUNT_INCLUDE_MODULE_PREFIX +TERRAGRUNT_NO_AUTO_INIT +TERRAGRUNT_NO_AUTO_RETRY ...

[{"body":"What is this?","diff_hunk":"@@ -23,6 +23,7 @@ spec:\n     metadata:\n       annotations:\n         cluster-autoscaler.kubernetes.io/safe-to-evict: 'true'\n+        sentry.io/image-sha: deploy-me","line":null,"start_line":null},{"body":"absolutely no idea","diff_hunk":"@@ -23,6 +23,7 @@ spec:\n     metadata:\n       annotations:\n         cluster-autoscaler.kubernetes.io/safe-to-evict: 'true'\n+        sentry.io/image-sha: deploy-me","line":null,"start_line":null},{"body":"This is a pod template annotation used as a deploy trigger for GoCD. The image tag is `nightly` (mutable), so k8s won't restart pods when a new image is pushed — the tag hasn't changed. Updating this annotation to the actual commit SHA forces GoCD to detect a diff in the materialized manifest, which triggers a rollout. The `\"deploy-me\"` placeholder value will be replaced with the real SHA on the first deploy.","diff_hunk":"@@ -23,6 +23,7 @@ spec:\n     metadata:\n       annotations:\n         ...

[
  {
    "content": "Fix check_ongoing_deploy: should be false (Cursor BugBot + human review)",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Remove cloudbuild IAM role for orbital (human review comment)",
    "status": "pending",
    "priority": "high"
  },
  {
    "content": "Resolve image-sha annotation thread (already resolved in conversation)",
    "status": "pending",
    "priority": "medium"
  },
  {
    "content": "Resolve nightly image tag thread (already resolved in conversation)",
    "status": "pending",
    "priority": "medium"
  },
  {
    "content": "TACOS Plan s4s2 failure - TF lock contention (not our issue)",
    "status": "pending",
    "priority": "low"
  }
]

<path>/home/byk/Code/getsentry/ops/gocd/templates/orbital-k8s.jsonnet</path>
<type>file</type>
<content>1: local gocd = import '../libs/gocd.libsonnet';
2: local pipedream = import 'github.com/getsentry/gocd-jsonnet/libs/pipedream.libsonnet';
3: 
4: local region_has_canary(region) = false;
5: local service_name = 'orbital';
6: local canary_selector = '.metadata.labels.env == "canary"';
7: local check_ongoing_deploy = true;
8: 
9: local k8s_pipeline(region) = gocd.k8s_pipeline(service_name, region, region_has_canary, canary_selector, check_ongoing_deploy);
10: 
11: // Orbital is only deployed to US
12: pipedream.render(gocd.pipedream_config(service_name, include_regions=['us']), k8s_pipeline)

(End of file - total 12 lines)
</content>

grep: terraform/sentryio/iam/iam.tf: No such file or directory

gocd/templates/orbital-k8s.jsonnet

37be420208 ref(orbital): use include_regions instead of exclude_regions blocklist
29a3f69c49 feat(orbital): switch to placeholder image tag + two-pipeline model
b9a2be321f Merge branch 'master' into byk/orbital-gocd-pipeline
3cec42112d Revert "ref: Slice process-spans in DE (#19282)"
0d8fa1e957 feat(orbital): add GoCD deploy pipeline for orbital-k8s

gocd/templates/orbital-k8s.jsonnet
k8s/materialized_manifests/us/default/orbital/default-deployment-orbital.yaml
k8s/services/orbital/deployment.yaml
terraform/internal-sentry/gke/gocd-bastion.tf
terraform/sentryio/iam/policies_project.tf
terragrunt/regions/multi-tenant/gke-main-cluster/service.hcl
terragrunt/regions/multi-tenant/iam/binding_project_non_authoritative/us/local.hcl

accepts at most 1 arg(s), received 2

+++ b/terraform/internal-sentry/gke/gocd-bastion.tf
@@ -34,6 +34,8 @@ module "devinfra-deployment-target" {
     "serviceAccount:deploy-to-mcrouter-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
     "serviceAccount:deploy-to-objectstore@dicd-team-devinfra-cd.iam.gserviceaccount.com",
     "serviceAccount:deploy-to-objectstore-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
+    "serviceAccount:deploy-to-orbital@dicd-team-devinfra-cd.iam.gserviceaccount.com",
+    "serviceAccount:deploy-to-orbital-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
     "serviceAccount:deploy-to-pgbouncer-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
     "serviceAccount:deploy-to-rabbitmq-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
     "serviceAccount:deploy-to-redash-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
diff --git a/terraform/sentryio/iam/policies_project.tf b/terraform/sentryio/iam/policies_project.tf
index 88978a881b1..11c8717c16f 100644
--
+++ ...

local gocd = import '../libs/gocd.libsonnet';
local pipedream = import 'github.com/getsentry/gocd-jsonnet/libs/pipedream.libsonnet';

local region_has_canary(region) = false;

local service_name = 'sendgrid-webhook';
local canary_selector = '.metadata.labels.env == "canary"';
// Only in US
local exclude_regions = ['s4s', 'de', 'itty-bitty', 'customer-1', 'customer-2', 'customer-4', 'customer-7'];
local check_ongoing_deploy = false;

local k8s_pipeline(region) = gocd.k8s_pipeline(service_name, region, region_has_canary, canary_selector, check_ongoing_deploy);

// Then call pipedream.render() to generate the set of pipelines for
// a getsentry "pipedream".
pipedream.render(gocd.pipedream_config(service_name, exclude_regions), k8s_pipeline)

Edit applied successfully.

<path>/home/byk/Code/getsentry/ops/terraform/sentryio/iam/policies_project.tf</path>
<type>file</type>
<content>95:     "serviceAccount:deploy-to-getsentry-backend@dicd-team-devinfra-cd.iam.gserviceaccount.com",
96:     "serviceAccount:deploy-to-getsentry-frontend@dicd-team-devinfra-cd.iam.gserviceaccount.com",
97:     "serviceAccount:deploy-to-launchpad-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
98:     "serviceAccount:deploy-to-launchpad@dicd-team-devinfra-cd.iam.gserviceaccount.com",
99:     "serviceAccount:deploy-to-objectstore@dicd-team-devinfra-cd.iam.gserviceaccount.com",
100:     "serviceAccount:deploy-to-objectstore-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
101:     "serviceAccount:deploy-to-orbital-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
102:     "serviceAccount:deploy-to-relay-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
103:     "serviceAccount:deploy-to-relay-pop-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
104:     ...

Edit applied successfully.

<skill_content name="commit">
# Skill: commit

# Sentry Commit Messages

Follow these conventions when creating commits for Sentry projects.

## Prerequisites

Before committing, always check the current branch:

```bash
git branch --show-current
```

**If you're on `main` or `master`, you MUST create a feature branch first** — unless the user explicitly asked to commit to main. Do not ask for confirmation; default to creating the branch.

```bash
# Create and switch to a new branch
git checkout -b <type>/<short-description>
```

Branch naming should follow the pattern: `<type>/<short-description>` where type matches the commit type (e.g., `feat/add-user-auth`, `fix/null-pointer-error`, `ref/extract-validation`).

## Format

```
<type>(<scope>): <subject>

<body>

<footer>
```

The header is required. Scope is optional. All lines must stay under 100 characters. ...

byk/orbital-gocd-pipeline

 gocd/templates/orbital-k8s.jsonnet         | 2 +-
 terraform/sentryio/iam/policies_project.tf | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

[byk/orbital-gocd-pipeline 7ceaea2d4f] fix(orbital): Set check_ongoing_deploy to false and remove cloudbuild IAM
 2 files changed, 1 insertion(+), 2 deletions(-)

remote: 
remote: GitHub found 90 vulnerabilities on getsentry/ops's default branch (2 critical, 27 high, 50 moderate, 11 low). To find out more, visit:        
remote:      https://github.com/getsentry/ops/security/dependabot        
remote: 
To https://github.com/getsentry/ops.git
   37be420208..7ceaea2d4f  byk/orbital-gocd-pipeline -> byk/orbital-gocd-pipeline

[{"first_comment":"What is this?","line":null,"path":"k8s/materialized_manifests/us/default/orbital/default-deployment-orbital.yaml","thread_id":"PRRT_kwDOAELX0s5xQXDE"},{"first_comment":"Does it make sense to keep the explicit version? This means that new versions can be deployed via the k8s pipeline by updating the image name, merge, deploy. \n\nA static `nightly` value will get picked up randomly when a pod is restarted.","line":null,"path":"k8s/materialized_manifests/us/default/orbital/default-deployment-orbital.yaml","thread_id":"PRRT_kwDOAELX0s5xQXyE"},{"first_comment":"### `check_ongoing_deploy` set to `true` contradicts intended behavior\n\n**Medium Severity**\n\n\u003c!-- DESCRIPTION START --\u003e\n`check_ongoing_deploy` is set to `true`, but the PR description explicitly states \"no ongoing deploy check\" and says this pipeline \"matches the `sendgrid-webhook-k8s` pattern exactly.\" The reference template `sendgrid-webhook-k8s.jsonnet` has `check_ongoing_deploy = false`. ...

{"data":{"addPullRequestReviewThreadReply":{"comment":{"id":"PRRC_kwDOAELX0s6rt4Ba"}}}}

{"errors":[{"path":["mutation","resolvePullRequestReviewThread"],"extensions":{"code":"undefinedField","typeName":"Mutation","fieldName":"resolvePullRequestReviewThread"},"locations":[{"line":1,"column":12}],"message":"Field 'resolvePullRequestReviewThread' doesn't exist on type 'Mutation'"}]}gh: Field 'resolvePullRequestReviewThread' doesn't exist on type 'Mutation'

{"data":{"resolveReviewThread":{"thread":{"isResolved":true}}}}

{"data":{"addPullRequestReviewThreadReply":{"comment":{"id":"PRRC_kwDOAELX0s6rt4gD"}}}}

{"data":{"resolveReviewThread":{"thread":{"isResolved":true}}}}

{"data":{"addPullRequestReviewThreadReply":{"comment":{"id":"PRRC_kwDOAELX0s6rt40P"}}}}

{"data":{"resolveReviewThread":{"thread":{"isResolved":true}}}}

{"data":{"addPullRequestReviewThreadReply":{"comment":{"id":"PRRC_kwDOAELX0s6rt5am"}}}}

{"data":{"resolveReviewThread":{"thread":{"isResolved":true}}}}

[
  {
    "content": "Fix check_ongoing_deploy: should be false (Cursor BugBot + human review)",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Remove cloudbuild IAM role for orbital (human review comment)",
    "status": "completed",
    "priority": "high"
  },
  {
    "content": "Resolve image-sha annotation thread (already resolved in conversation)",
    "status": "completed",
    "priority": "medium"
  },
  {
    "content": "Resolve nightly image tag thread (already resolved in conversation)",
    "status": "completed",
    "priority": "medium"
  },
  {
    "content": "TACOS Plan s4s2 failure - TF lock contention (not our issue)",
    "status": "completed",
    "priority": "low"
  }
]

Waiting 60 seconds for CI to start...
IN_PROGRESS	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/de)
IN_PROGRESS	tacos-gha / TACOS Plan (terraform/internal-sentry/gke)
IN_PROGRESS	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/iam/binding_project_non_authoritative/us)
IN_PROGRESS	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/control-region)
IN_PROGRESS	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)
IN_PROGRESS	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/edge)
IN_PROGRESS	create salt manifest and base packer image (12, arm64)
IN_PROGRESS	create salt manifest and base packer image (12, amd64)
IN_PROGRESS	create salt manifest and base packer image (13, arm64)
IN_PROGRESS	create salt manifest and base packer image (13, amd64)
NEUTRAL	Cursor Bugbot

Waiting 90 more seconds for CI...
FAILURE	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)
IN_PROGRESS	create salt manifest and base packer image (13, amd64)
IN_PROGRESS	create salt manifest and base packer image (12, amd64)
NEUTRAL	Cursor Bugbot

tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-03-03T23:06:08.6672038Z $ env GETSENTRY_SAC_VERB=state-admin sudo-gcp tf-lock-acquire
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-03-03T23:06:33.5868580Z tf-lock-acquire: failure: not mwarkentin@18162.ops.getsentry.github.invalid: .(BYK@19386.ops.getsentry.github.invalid)
tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)	UNKNOWN STEP	2026-03-03T23:06:34.3990895Z ##[error]Process completed with exit code 1.

Waiting 60 more seconds...
FAILURE	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)
NEUTRAL	Cursor Bugbot

[{"body":"### Config-image deploy race check incorrectly disabled\n\n**Medium Severity**\n\n\u003c!-- DESCRIPTION START","line":7,"start_line":null}]

[{"comments":[{"author":"cursor","body":"### Config-image deploy race check incorrectly disabled\n\n**Medium Severity**\n\n\u003c!-- DESCRIPTION START --\u003e\n`check_ongoing_deploy` is set to `false`, but the PR description states it was \"Enabled … so config changes don't race with image deploys.\" Orbital has *two* separate GoCD pipelines (`orbital` for image deploys and `orbital-k8s` for config deploys, both registered in `service.hcl`). With this flag disabled, the config pipeline won't wait for a running image deploy to finish, creating the exact race condition the PR description says this flag prevents. The justification of matching `sendgrid-webhook-k8s` doesn't apply because sendgrid-webhook only has a single `-k8s` pipeline — no separate image deploy pipeline to race with.\n\u003c!-- DESCRIPTION END --\u003e\n\n\u003c!-- BUGBOT_BUG_ID: 042d4d44-d015-4a82-8273-730834330a0d --\u003e\n\n\u003c!-- LOCATIONS START\ngocd/templates/orbital-k8s.jsonnet#L6-L7\nLOCATIONS END ...

gocd/templates/orbital-k8s.jsonnet

    "getsentry-k8s",
    "iap-ingress-k8s",
    "keda-auth-k8s",
    "launchpad-k8s",
    "lb-cert-update-k8s",
    "orbital",
    "orbital-k8s",
    "pgbouncer-k8s",
    "rabbitmq-k8s",
    "redash-k8s",
    "relay-k8s",
    "relay-pop-k8s",

70:    "orbital",
71:    "orbital-k8s",

File does not exist

ls: cannot access 'gocd/generated/orbital*': No such file or directory

gocd/templates/orbital-k8s.jsonnet:local service_name = 'orbital';

{"data":{"addPullRequestReviewThreadReply":{"comment":{"id":"PRRC_kwDOAELX0s6ruD7b"}}}}

{"data":{"resolveReviewThread":{"thread":{"isResolved":true}}}}

[]

FAILURE	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)
NEUTRAL	Cursor Bugbot

=== All CI checks ===
FAILURE	tacos-gha / TACOS Plan (terragrunt/regions/multi-tenant/gke-main-cluster/s4s2)
NEUTRAL	Cursor Bugbot
SKIPPED	apply-kafka-management-configmap
SKIPPED	apply-snuba-admin-configmap
SKIPPED	apply-topicctl-configmap
SKIPPED	create salt manifest and base packer image
SKIPPED	Helm Materialization
SKIPPED	K8s CI - Validate Region Configurations
SKIPPED	Run tests
SKIPPED	tacos-gha / reset-label / Reset Label
SKIPPED	Test Spacelift Admin
SKIPPED	Workflows Materialization
SUCCESS	Adds Ops Assistant comment
SUCCESS	Auto Approve PR
SUCCESS	create salt manifest and base packer image (12, amd64)
SUCCESS	create salt manifest and base packer image (12, arm64)
SUCCESS	create salt manifest and base packer image (13, amd64)
SUCCESS	create salt manifest and base packer image (13, arm64)
SUCCESS	files-changed / detect what files changed
SUCCESS	files-changed / detect what files changed
SUCCESS	files-changed / detect what files changed
SUCCESS	files-changed / detect what files ...

No results found for this query.

gocd/templates/super-big-consumers-k8s.jsonnet:    elastic_profile_id: 'sbc-k8s',
gocd/templates/libs/k8s.libsonnet:    elastic_profile_id: profile,
gocd/templates/libs/k8s.libsonnet:    elastic_profile_id: profile,
gocd/templates/libs/k8s.libsonnet:    elastic_profile_id: profile,
gocd/templates/libs/k8s.libsonnet:    elastic_profile_id: profile,
gocd/templates/libs/gocd.libsonnet:    elastic_profile_id: service_name + '-k8s',
gocd/templates/symbolicator-k8s.jsonnet:    elastic_profile_id: 'symbolicator-k8s',
gocd/templates/getsentry-k8s.jsonnet:    elastic_profile_id: 'getsentry-k8s',
gocd/templates/relay-k8s.jsonnet:    elastic_profile_id: 'relay-k8s',
gocd/templates/relay-pop-k8s.jsonnet:    elastic_profile_id: 'relay-pop-k8s',
gocd/templates/pipelines/uptime-checker-k8s.libsonnet:          elastic_profile_id: 'uptime-checker-k8s',
gocd/templates/pipelines/uptime-checker-k8s.libsonnet:        elastic_profile_id: 'uptime-checker-k8s',
gocd/templates/uptime-checker-k8s.jsonnet:    ...

99:    elastic_profile_id: service_name + '-k8s',

gocd/pipelines/deploy-edge-anti-abuse.yaml
gocd/pipelines/deploy-edge-anti-abuse-schnell.yaml
gocd/pipelines/deploy-edge-relay.yaml

gocd/pipelines/deploy-edge-anti-abuse.yaml:              elastic_profile_id: relay-pop-k8s
gocd/pipelines/deploy-edge-anti-abuse.yaml:              elastic_profile_id: relay-pop-k8s
gocd/pipelines/deploy-edge-anti-abuse.yaml:              elastic_profile_id: relay-pop-k8s
gocd/pipelines/deploy-edge-anti-abuse.yaml:              elastic_profile_id: relay-pop-k8s
gocd/pipelines/deploy-edge-anti-abuse.yaml:              elastic_profile_id: relay-pop-k8s

local gocd = import '../libs/gocd.libsonnet';
local pipedream = import 'github.com/getsentry/gocd-jsonnet/libs/pipedream.libsonnet';

local region_has_canary(region) = false;

local service_name = 'sendgrid-webhook';
local canary_selector = '.metadata.labels.env == "canary"';
// Only in US
local exclude_regions = ['s4s', 'de', 'itty-bitty', 'customer-1', 'customer-2', 'customer-4', 'customer-7'];
local check_ongoing_deploy = false;

local k8s_pipeline(region) = gocd.k8s_pipeline(service_name, region, region_has_canary, canary_selector, check_ongoing_deploy);

// Then call pipedream.render() to generate the set of pipelines for
// a getsentry "pipedream".
pipedream.render(gocd.pipedream_config(service_name, exclude_regions), k8s_pipeline)

terraform/internal-sentry/gke/gocd-bastion.tf:    "serviceAccount:deploy-to-sendgrid-webhook-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",
terragrunt/regions/multi-tenant/gke-main-cluster/service.hcl:    "sendgrid-webhook-k8s",

    "serviceAccount:deploy-to-sendgrid-webhook-k8s@dicd-team-devinfra-cd.iam.gserviceaccount.com",

{"body":"Part of setting up proper CI/CD for sentry-orbital using the same two-pipeline model as getsentry/getsentry.\n\n## Changes\n\nAdds **two** entries to the `deploy-configs` map in `terraform/env/prod/terraform.tfvars`:\n\n1. **`orbital`** — Image deploy pipeline. Points at `sentry-orbital` repo (main branch). GoCD pipeline jsonnet lives in `sentry-orbital/gocd/templates/`. Creates:\n   - GCS asset bucket\n   - SA: `deploy-to-orbital@dicd-team-devinfra-cd.iam.gserviceaccount.com`\n   - GoCD config repo watching `sentry-orbital/main`\n\n2. **`orbital-k8s`** — Config deploy pipeline (already added). Points at `ops` repo. Handles k8s manifest changes (replicas, resources, etc.) without touching the image.\n\n## Related PRs\n\n- **sentry-orbital**: https://github.com/getsentry/sentry-orbital/pull/10 — GoCD deploy pipeline\n- **ops**: https://github.com/getsentry/ops/pull/19386 — k8s manifests + IAM for both SAs\n\n> **Merge order**: This should be merged and `terraform apply`'d ...

diff --git a/terraform/env/prod/terraform.tfvars b/terraform/env/prod/terraform.tfvars
index 8db107ba..d15fcab1 100644
--- a/terraform/env/prod/terraform.tfvars
+++ b/terraform/env/prod/terraform.tfvars
@@ -29,6 +29,12 @@ deploy-configs = {
       "serviceAccount:gha-gcr-push@sac-prod-sa.iam.gserviceaccount.com",
     ],
   }
+  orbital = {
+    repo-name   = "sentry-orbital",
+    repo-branch = "master",
+    config-dir  = "gocd/**/*.jsonnet,gocd/**/jsonnetfile.json,gocd/pipelines/*.yaml",
+    plugin-id   = "jsonnet.config.plugin",
+  }
   sentry-options-automator = {
     asset-writers = [
       "serviceAccount:294472738882@cloudbuild.gserviceaccount.com",
@@ -442,6 +448,12 @@ deploy-configs = {
     config-dir  = "gocd/**/*.jsonnet,gocd/**/jsonnetfile.json,gocd/pipelines/*.yaml",
     plugin-id   = "jsonnet.config.plugin",
   }
+  orbital-k8s = {
+    repo-name   = "ops",
+    repo-branch = "master",
+    config-dir  = ...

{"mergeCommit":{"oid":"7c421314514fb08c25fb453e37bcef4f381cee60"},"mergedAt":"2026-03-03T22:57:40Z"}

Addressed review comments in 4cdc6c4:
- Added `gocd/pipelines/*.yaml` to `config-dir` glob for consistency with all other entries
- Added `repo-branch = "master"` since `sentry-orbital` uses `master` as its default branch (config defaults to `main`)
- Moved the `orbital` entry from the k8s section to the deploy pipelines section (between `objectstore` and `sentry-options-automator`)

1

[{"name":"Seer Code Review","state":"SUCCESS"},{"name":"Secret Scan","state":"SUCCESS"},{"name":"test","state":"SUCCESS"},{"name":"test-agent","state":"SUCCESS"},{"name":"pre-commit","state":"SUCCESS"},{"name":"Cursor Bugbot","state":"NEUTRAL"},{"name":"semgrep-cloud-platform/scan","state":"SUCCESS"}]

local k8s = import './k8s.libsonnet';

local k8s_diff_stages(svc, region) =
  [
    {
      diff: {
        fetch_materials: true,
        jobs: {
          ['diff-' + region]: k8s.diff_job(region, svc + '-k8s', svc),
        },
      },
    },
  ];

local apply_canary_stages(svc, region, region_has_canary=null, canary_selector='.metadata.labels.env == "canary"') =
  if region_has_canary == null then
    []
  else if region_has_canary(region) then
    [
      {
        'apply-canary': {
          fetch_materials: true,
          jobs: {
            ['apply-canary-' + region]: k8s.apply_job(
              region,
              svc + '-k8s',
              svc,
              canary_selector,
            ),
          },
        },
      },
    ]
  else
    [];

local apply_primary_stages(svc, region, is_manual) =
  [
    {
      'apply-primary': {
        fetch_materials: true,
        approval: {
          type: if is_manual then 'manual' else 'success',
        },
        jobs: {
       ...