namespace

package
v1.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: Apache-2.0 Imports: 8 Imported by: 0

Documentation

Index

Constants

View Source 
const DefaultNamespace = "default"

DefaultNamespace is the standard fallback namespace for all resources.

Variables

View Source 
var (
	// ErrNamespaceNotFound indicates that the requested namespace does not exist.
	ErrNamespaceNotFound = errors.New("namespace not found")

	// ErrNamespaceAlreadyExists indicates that a namespace with the same name already exists in the tenant.
	ErrNamespaceAlreadyExists = errors.New("namespace already exists")

	// ErrInvalidNamespaceName indicates that the namespace name violates RFC 1123 DNS-1123 label standards.
	ErrInvalidNamespaceName = errors.New("invalid namespace name")

	// ErrNamespaceTerminating indicates that the namespace is in Terminating phase and cannot accept new resources.
	ErrNamespaceTerminating = errors.New("namespace is terminating")

	// ErrDefaultNamespaceProtected indicates an attempt to delete or decommission the immutable 'default' namespace.
	ErrDefaultNamespaceProtected = errors.New("the default namespace is protected and cannot be deleted")

	// ErrQuotaExceeded indicates a resource request exceeds the limits defined in the namespace's ResourceQuota.
	ErrQuotaExceeded = errors.New("resource quota exceeded")

	// ErrNamespaceNotEmpty indicates that a namespace cannot be purged because it still contains active resources.
	ErrNamespaceNotEmpty = errors.New("namespace contains active resources and cannot be deleted")

	// ErrCrossNamespaceForbidden indicates that cross-namespace communication or access is disallowed by policy.
	ErrCrossNamespaceForbidden = errors.New("cross-namespace access is forbidden by policy")
)

Functions

func ValidateNamespaceName 

func ValidateNamespaceName(name string) error

ValidateNamespaceName ensures a namespace name conforms strictly to RFC 1123 DNS-1123 label rules.

Types

type Enforcer 

type Enforcer struct {
	// contains filtered or unexported fields
}

Enforcer performs admission and policy enforcement on namespaces and resource quotas.

func NewEnforcer 

func NewEnforcer(store Store) *Enforcer

NewEnforcer creates a new Enforcer backed by a namespace Store.

func (*Enforcer) CheckIPCPermission 

func (e *Enforcer) CheckIPCPermission(ctx context.Context, senderTenant, senderNS, receiverTenant, receiverNS string) error

CheckIPCPermission evaluates cross-namespace rules between sender and receiver.

func (*Enforcer) CheckMailboxAdmission 

func (e *Enforcer) CheckMailboxAdmission(ctx context.Context, tenantID, nsName string) error

CheckMailboxAdmission checks if a mailbox message can be admitted without overflowing quota.

func (*Enforcer) CheckNamespaceActive 

func (e *Enforcer) CheckNamespaceActive(ctx context.Context, tenantID, nsName string) (*Namespace, error)

CheckNamespaceActive verifies that a namespace exists and is in the Active phase.

func (*Enforcer) CheckServiceAdmission 

func (e *Enforcer) CheckServiceAdmission(ctx context.Context, tenantID, nsName string, isNewService bool, replicas int) error

CheckServiceAdmission validates whether a new service can be created or scaled in the namespace.

func (*Enforcer) CheckTaskAdmission 

func (e *Enforcer) CheckTaskAdmission(ctx context.Context, tenantID, nsName string, budget store.TaskBudget) error

CheckTaskAdmission validates whether a new task can be admitted into the namespace.

type MemoryStore 

type MemoryStore struct {
	// contains filtered or unexported fields
}

MemoryStore is an in-memory, thread-safe implementation of Store.

func NewMemoryStore 

func NewMemoryStore() *MemoryStore

NewMemoryStore creates a new in-memory namespace store with UTC clock.

func NewMemoryStoreWithClock 

func NewMemoryStoreWithClock(clock func() time.Time) *MemoryStore

NewMemoryStoreWithClock creates an in-memory namespace store with a customized clock.

func (*MemoryStore) CreateNamespace 

func (s *MemoryStore) CreateNamespace(ctx context.Context, ns *Namespace) error

CreateNamespace creates a new namespace.

func (*MemoryStore) DeleteNamespace 

func (s *MemoryStore) DeleteNamespace(ctx context.Context, tenantID, name string) error

DeleteNamespace removes a namespace if it is not "default" and has no active resources.

func (*MemoryStore) GetNamespace 

func (s *MemoryStore) GetNamespace(ctx context.Context, tenantID, name string) (*Namespace, error)

GetNamespace retrieves a namespace by tenant and name.

func (*MemoryStore) GetUsage 

func (s *MemoryStore) GetUsage(ctx context.Context, tenantID, name string) (*ResourceUsage, error)

GetUsage returns current resource usage for a namespace.

func (*MemoryStore) ListNamespaces 

func (s *MemoryStore) ListNamespaces(ctx context.Context, tenantID string) ([]*Namespace, error)

ListNamespaces lists all namespaces in the tenant.

func (*MemoryStore) RecordUsageDelta 

func (s *MemoryStore) RecordUsageDelta(ctx context.Context, tenantID, name string, delta ResourceUsageDelta) error

RecordUsageDelta applies incremental changes to resource usage counters.

func (*MemoryStore) UpdateNamespace 

func (s *MemoryStore) UpdateNamespace(ctx context.Context, ns *Namespace) error

UpdateNamespace updates the metadata, labels, and quota of an existing namespace.

type Namespace 

type Namespace struct {
	TenantID    string            `json:"tenant_id"`
	Name        string            `json:"name"`
	DisplayName string            `json:"display_name,omitempty"`
	Description string            `json:"description,omitempty"`
	Phase       NamespacePhase    `json:"phase"`
	Labels      map[string]string `json:"labels,omitempty"`
	Quota       ResourceQuota     `json:"quota"`
	CreatedAt   time.Time         `json:"created_at"`
	UpdatedAt   time.Time         `json:"updated_at"`
}

Namespace is a first-class isolation and resource management boundary in Fenced.

func NewDefaultNamespace 

func NewDefaultNamespace(tenantID string) *Namespace

NewDefaultNamespace returns a standard active default namespace for a tenant.

type NamespacePhase 

type NamespacePhase string

NamespacePhase represents the operational lifecycle state of a namespace. 

const (
	// NamespacePhaseActive indicates the namespace is healthy and accepts workloads.
	NamespacePhaseActive NamespacePhase = "Active"
	// NamespacePhaseTerminating indicates the namespace is being deleted; new resources are rejected.
	NamespacePhaseTerminating NamespacePhase = "Terminating"
)

type NamespaceSpec 

type NamespaceSpec struct {
	TenantID    string            `json:"tenant_id"`
	Name        string            `json:"name"`
	DisplayName string            `json:"display_name,omitempty"`
	Description string            `json:"description,omitempty"`
	Labels      map[string]string `json:"labels,omitempty"`
	Quota       ResourceQuota     `json:"quota"`
}

NamespaceSpec contains parameters for creating or updating a Namespace.

type ResourceQuota 

type ResourceQuota struct {
	MaxServices            int   `json:"max_services,omitempty"`
	MaxReplicasPerService  int   `json:"max_replicas_per_service,omitempty"`
	MaxTasks               int   `json:"max_tasks,omitempty"`
	MaxTokens              int64 `json:"max_tokens,omitempty"`
	MaxCostMicroUSD        int64 `json:"max_cost_micro_usd,omitempty"`
	MaxToolCalls           int64 `json:"max_tool_calls,omitempty"`
	MaxWallSeconds         int64 `json:"max_wall_seconds,omitempty"`
	MaxIPCMailboxMessages  int   `json:"max_ipc_mailbox_messages,omitempty"`
	AllowCrossNamespaceIPC bool  `json:"allow_cross_namespace_ipc,omitempty"`
}

ResourceQuota defines hard resource limits and policy gates enforced within a namespace. Any dimension <= 0 is treated as unlimited.

type ResourceUsage 

type ResourceUsage struct {
	TenantID             string    `json:"tenant_id"`
	Namespace            string    `json:"namespace"`
	ActiveServices       int       `json:"active_services"`
	ActiveInstances      int       `json:"active_instances"`
	ActiveTasks          int       `json:"active_tasks"`
	MailboxMessages      int       `json:"mailbox_messages"`
	ConsumedTokens       int64     `json:"consumed_tokens"`
	ConsumedCostMicroUSD int64     `json:"consumed_cost_micro_usd"`
	ConsumedToolCalls    int64     `json:"consumed_tool_calls"`
	ConsumedWallSeconds  int64     `json:"consumed_wall_seconds"`
	UpdatedAt            time.Time `json:"updated_at"`
}

ResourceUsage tracks the current live and settled resource consumption in a namespace.

type ResourceUsageDelta 

type ResourceUsageDelta struct {
	ActiveServicesDelta       int
	ActiveInstancesDelta      int
	ActiveTasksDelta          int
	MailboxMessagesDelta      int
	ConsumedTokensDelta       int64
	ConsumedCostMicroUSDDelta int64
	ConsumedToolCallsDelta    int64
	ConsumedWallSecondsDelta  int64
}

ResourceUsageDelta represents incremental changes to resource usage counters.

type Store 

type Store interface {
	// CreateNamespace creates a new namespace in the given tenant.
	// Returns ErrNamespaceAlreadyExists if a namespace with the same name exists.
	// Returns ErrInvalidNamespaceName if name does not satisfy RFC 1123.
	CreateNamespace(ctx context.Context, ns *Namespace) error

	// GetNamespace retrieves a namespace by tenant and name.
	// If the name is "default" and has not been explicitly created yet, the store
	// should transparently initialize and return the default namespace.
	// Returns ErrNamespaceNotFound if not found.
	GetNamespace(ctx context.Context, tenantID, name string) (*Namespace, error)

	// UpdateNamespace updates the metadata, labels, and quota of an existing namespace.
	// Returns ErrNamespaceNotFound if it does not exist.
	UpdateNamespace(ctx context.Context, ns *Namespace) error

	// DeleteNamespace marks or deletes a namespace.
	// Returns ErrDefaultNamespaceProtected if name == "default".
	// Returns ErrNamespaceNotFound if it does not exist.
	// Returns ErrNamespaceNotEmpty if the namespace currently holds active workloads or services.
	DeleteNamespace(ctx context.Context, tenantID, name string) error

	// ListNamespaces lists all namespaces within a tenant.
	ListNamespaces(ctx context.Context, tenantID string) ([]*Namespace, error)

	// GetUsage returns the current active and settled resource usage in the namespace.
	GetUsage(ctx context.Context, tenantID, name string) (*ResourceUsage, error)

	// RecordUsageDelta applies incremental changes to resource usage counters.
	RecordUsageDelta(ctx context.Context, tenantID, name string, delta ResourceUsageDelta) error
}

Store defines persistence and retrieval operations for namespaces and their resource usage.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.