- Shipped
- September 4, 2026 at 9:51 PM UTC
- Author
- Kamo
- Commit
- 616e0a8
Caught in production the moment services went to two replicas on 2026-09-04. Every pod carrying this class logged, once, at boot: [Webhook] Failed to subscribe JetStream consumer: [SUB-90012] Consumer is already bound to a subscription. A durable push consumer with no deliver group admits exactly ONE subscriber, and this worker has no retry. Webhooks were still being delivered — by whichever pod bound first — so the failure is invisible right up until THAT pod is the one that dies, at which point delivery stops entirely and the surviving pod never picks it up. A single log line at boot is the only warning. The consumer now joins a deliver group, so NATS hands each webhook to exactly one pod and any pod can take over. That is what webhook delivery wants: once, not once per pod, and not once per pod that happened to win a race. reconcileDeliverGroup() deletes a consumer that exists WITHOUT the group before subscribing — mandatory, because every existing one is in the old shape and jnats will not join a plain durable as a queue member. It refuses the bind and keeps refusing it. Recreating costs nothing: the deliver policy is New/Last, so a fresh consumer starts where the old one was. The stream name reads NatsConfig's own **************** rather than declaring a second property for the same stream, so a rename cannot leave the reconcile looking elsewhere. This class lives in the shared library, so the fix reaches each service on its next build. Until then delivery keeps working on the bound pod; what is missing is only the failover.