Architecture
InfraSage is a set of loosely coupled microservices joined by a Kafka-compatible message bus and a shared ClickHouse time-series database.
Data flow
Services
Ingestion Gateway (:8080)
The single entry point for telemetry. It:
- Detects the payload format on its own, whether that is Prometheus remote-write, OTLP, or JSON
- Validates timestamp freshness, value ranges, and required fields
- Deduplicates by content hash, so a retry cannot write the same record twice
- Parks invalid records in the dead-letter queue for inspection and replay
- Publishes valid records to the
raw-telemetrytopic
Telemetry Operator (:8081)
Consumes from Kafka and processes the stream. It translates each source format into one canonical TelemetryRecord, adds inferred metadata such as service discovery and environment tagging, and accumulates records for batched writes to ClickHouse (10,000 records by default). High-cardinality trace and span references are stored separately as exemplars.
AIops Engine (:8080 plus the :9093 webhook)
Where detection and analysis happen:
- The Watchdog polls ClickHouse on a configurable interval and keeps a per-metric ring buffer for sliding-window Z-score analysis
- Isolation Forest scores several metrics at once, so it catches combinations that no single metric flags
- LLM RCA sends anomaly context to Anthropic Claude and gets back a structured root cause, suggested actions, and a confidence score
- Vector memory is an HNSW index of past incidents that matches a new anomaly to historical patterns by meaning rather than by string
- The runbook executor runs remediation against Kubernetes, HTTP, shell, and Slack, behind approval gates and with rollback
- Multi-tenancy enforces RBAC, per-tenant quotas, and data isolation
Integration Poller
Polls external systems continuously: AWS CloudWatch for EC2, RDS, Lambda, ALB, DynamoDB, and S3 metrics, and Kubernetes for pod and node metrics and namespace events.
RCA MCP Server
Exposes InfraSage's RCA capabilities as a Model Context Protocol (MCP) server, so AI agents can query root-cause analysis results programmatically.
Infrastructure components
| Component | Version | Purpose |
|---|---|---|
| ClickHouse | v26+ | Time-series storage with MergeTree engine |
| Redpanda | v23.3+ | Kafka-compatible message broker |
| Prometheus | latest | Metric scraping and alerting |
| Grafana | latest | Visualization dashboards |
Database schema (key tables)
| Table | Purpose |
|---|---|
infrasage_raw_firehose | All ingested telemetry |
infrasage_exemplars | High-cardinality trace/span data |
infrasage_telemetry_catalog | Service/metric discovery |
infrasage_anomalies | Detected anomalies with scores |
infrasage_rca_results | RCA outputs from Claude |
infrasage_incidents | Correlated incident groups |
infrasage_knowledge_base | Historical RCA learnings |
infrasage_api_keys | Tenant API keys |
infrasage_usage_metering | Hourly event counts per tenant |
infrasage_billing_plans | Free/Starter/Pro/Enterprise definitions |
infrasage_audit_log | All state changes (365-day TTL) |
Technology stack
| Layer | Technology |
|---|---|
| Language | Go 1.25 (statically compiled) |
| Storage | ClickHouse (columnar, MergeTree) |
| Messaging | Redpanda / Kafka (franz-go client) |
| Monitoring | Prometheus + Grafana |
| Tracing | OpenTelemetry |
| AI | Anthropic Claude API |
| Vector Index | HNSW (custom Go implementation) |
| Auth | JWT (golang.org/x/crypto) |
| Containers | Docker + Kubernetes |
| Cloud | AWS SDK v2 |