fix(tra-974): pin preview backend LOG_LEVEL=info to stop debug log firehose

argocd/root/templates/trakrf-backend.yaml

@@ -21,6 +21,15 @@
 {{- if $cfg.jwtExpirationSeconds }}
 {{- $base = printf "%s  jwtExpirationSeconds: %q\n" $base $cfg.jwtExpirationSeconds }}
 {{- end }}
+{{- /* Per-env runtime log level (TRA-974). Maps to the chart's
+       config.runtimeLogLevel → LOG_LEVEL env the backend logger reads. Preview
+       pins "info" to silence the EnvDev debug default (per-message ingest
+       firehose); prod/unset envs fall back to the backend's APP_ENV default
+       (production→warn). A config sub-key, so append BEFORE the top-level
+       image:/mqtt:/emailGuard: blocks. */ -}}
+{{- if $cfg.logLevel }}
+{{- $base = printf "%s  runtimeLogLevel: %q\n" $base $cfg.logLevel }}
+{{- end }}
 {{- if $cfg.imageTag }}
 {{- $base = printf "%simage:\n  tag: %q\n" $base $cfg.imageTag }}
 {{- end }}

argocd/root/values.yaml

@@ -89,6 +89,10 @@ envs:
     imageTag: ""
     environmentLabel: preview
     jwtExpirationSeconds: "900"
+    # Preview detects as EnvDev → the backend logger defaults to debug, a 24/7
+    # per-message ingest firehose into Cloud Logging. Pin info (TRA-974); prod
+    # omits this and keeps its APP_ENV→warn default.
+    logLevel: info
     dbCluster:
       enabled: true
       fullnameOverride: trakrf-db-preview

helm/trakrf-backend/templates/configmap.yaml

@@ -8,6 +8,13 @@ data:
   APP_ENV: {{ .Values.config.appEnv | quote }}
   ENVIRONMENT_LABEL: {{ .Values.config.environmentLabel | quote }}
   BACKEND_LOG_LEVEL: {{ .Values.config.logLevel | quote }}
+{{- with .Values.config.runtimeLogLevel }}
+  # LOG_LEVEL is the runtime level the Go backend logger reads (logger/config.go);
+  # BACKEND_LOG_LEVEL above is legacy and unread by the current backend. Emitted
+  # only when set, so envs that omit it (prod) keep their APP_ENV→warn default and
+  # render no LOG_LEVEL key. Set per-env via the root app (preview→info). TRA-974.
+  LOG_LEVEL: {{ . | quote }}
+{{- end }}
   SERVICE_NAME: {{ .Values.config.serviceName | quote }}
   BACKEND_CORS_ORIGIN: {{ .Values.config.corsOrigin | quote }}
   JWT_EXPIRATION: {{ .Values.config.jwtExpirationSeconds | quote }}

helm/trakrf-backend/values.yaml

@@ -140,6 +140,12 @@ mqtt:
 config:
   appEnv: production
   logLevel: info
+  # runtimeLogLevel → the LOG_LEVEL env the Go backend logger actually reads
+  # (logger/config.go). Empty = inherit the backend's APP_ENV-based default
+  # (production→warn, dev/preview→debug). Set per-env (preview→info) to pin a
+  # level. NOTE: logLevel above feeds the legacy BACKEND_LOG_LEVEL key, which the
+  # current backend does NOT read — dead-key cleanup tracked in TRA-974.
+  runtimeLogLevel: ""
   serviceName: trakrf-backend
   corsOrigin: ""
   jwtExpirationSeconds: "3600"