ClickHouse Tag-Set RLS Pipeline

ClickHouse Tag-Set RLS Pipeline A data-flow diagram generated by Archify. 01 / Request 02 / Pod Cache 03 / RLS Rewrite 04 / ClickHouse 05 / Serialization SQL Query · Role Tag Sets · 01 / Request · fleet:delivery SQL Query Role Tag Sets fleet:delivery Per-Pod LRU · Local Cache · 02 / Pod Cache · 0-row short TTL Per-Pod LRU Local Cache 0-row short TTL Tag RLS UDF · matchesTagSets · 03 / RLS Rewrite · *:* | key:val Tag RLS UDF matchesTagSets *:* | key:val ClickHouse · Vectorized SQL · 04 / ClickHouse · arrayExists ClickHouse Vectorized SQL arrayExists Type Coercer · Tuple(Map) Cast · 05 / Serialization · Safe JS JSON Type Coercer Tuple(Map) Cast Safe JS JSON query + tags cache miss parameterized UDF filtered rows Legend primary data policy / PII async batch data store

Wildcard Tag Sets

  • • Evaluates array of tag maps against Map(String, String) inside ClickHouse
  • • Supports *.*, key:*, *:value, and exact key:value without post-filtering in Node

Local LRU Over Redis

  • • Multi-MB chart payloads saturated shared Redis bandwidth across the platform
  • • Bounded per-pod LRU protected ClickHouse while restoring Redis latency

Driver Safety

  • • Compound Tuple(Map(String, String)) columns coerced before JSON serialization
  • • Strict query settings prevent numeric parse errors and dev node OOMs