README
¶
fiberd on Kubernetes
Retiring. This example stays only until the fiberd-k8s-controller project replaces it. The Kubernetes home is part of fiberd's core, and a grant Pod runs fiberd's own image with
fiberd -home kubernetes(design).
This example runs fiberd on a cluster. A controller turns each CapacityGrant resource into a signed grant and a grant Pod that runs fiberd. It is for anyone who wants to run fiberd on a Kubernetes cluster. It is its own Go module and is not imported by fiberd.
What it proves
- A home for Kubernetes needs only the home interface. fiberd is unmodified.
- The grant Pod passes fiberd's conformance suite, run from the host against the Pod.
- Under a 384 MiB Pod limit, a burst of clones that asks for more memory than the Pod has parks fibers before any out-of-memory (OOM) kill.
- An
UNTRUSTEDgrant on gVisor (60-gvisor.yaml) serves a client in another Pod over the Pod IP, and its fiber keeps its state across a park and resume.make conform-kindruns this check last, andkind/conform.sh gvisorruns it alone.
This example runs fiberd with -insecure-plaintext.
Run it
Run it from the repository root. It needs Docker, kind (Kubernetes in Docker, which runs a test cluster on one machine), kubectl and Go.
make conform-kind
Design
How the controller, the grant Pod and the home work, and the known gaps, are in the Kubernetes design.
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
fiberd-k8s
command
Command fiberd-k8s is fiberd for a Kubernetes grant Pod: the library (pkg/fiberd) plus the Kubernetes home.
|
Command fiberd-k8s is fiberd for a Kubernetes grant Pod: the library (pkg/fiberd) plus the Kubernetes home. |
|
grant-controller
command
Command grant-controller is the Kubernetes issuer: fiberd's reference issuer (pkg/grant) run as a controller.
|
Command grant-controller is the Kubernetes issuer: fiberd's reference issuer (pkg/grant) run as a controller. |
|
Package controller is the Kubernetes side of the reference issuer: it turns CapacityGrant resources into signed grants and grant Pods.
|
Package controller is the Kubernetes side of the reference issuer: it turns CapacityGrant resources into signed grants and grant Pods. |
|
Package home is the Kubernetes home: fiberd is PID 1 of a grant Pod.
|
Package home is the Kubernetes home: fiberd is PID 1 of a grant Pod. |
|
Package kube is the slice of the Kubernetes API fiberd touches, as plain HTTPS requests with the projected service-account token: get, list, create, patch and delete on a handful of resources.
|
Package kube is the slice of the Kubernetes API fiberd touches, as plain HTTPS requests with the projected service-account token: get, list, create, patch and delete on a handful of resources. |
|
kubetest
Package kubetest is an in-memory stand-in for the API server, enough for the controller and the home to be tested without a cluster: objects keyed by path, collections listed by prefix, merge patches applied, uids assigned on create, owner references garbage-collected on delete.
|
Package kubetest is an in-memory stand-in for the API server, enough for the controller and the home to be tested without a cluster: objects keyed by path, collections listed by prefix, merge patches applied, uids assigned on create, owner references garbage-collected on delete. |