executor

type AgentResources ¶

type AgentResources struct {
	CPURequest    string
	MemoryRequest string
	CPULimit      string
	MemoryLimit   string
}

AgentResources sets the agent container's CPU/memory requests and limits. Values are Kubernetes quantity strings (e.g. "200m", "1Gi"); an empty field falls back to the executor's corresponding Config default. The Docker executor ignores this.

type CredentialConsumer ¶

type CredentialConsumer interface {
	SetAPIServerCredential(get func() string)
}

CredentialConsumer is an optional capability an Executor implements when it makes its own calls to the API server. The Worker's credential is minted at registration and rotated, so it does not exist at construction; the getter reads whatever is currently cached. An Executor that makes no such calls leaves this unimplemented, and the Worker skips it via a type assertion.

type ExecutionIdentity ¶

type ExecutionIdentity struct {
	ServiceAccount string
}

ExecutionIdentity is the identity a workload runs under. The namespace a workload launches into is a property of the executor instance (bound at construction), not of a single call, so it is not carried here.

type ExecutionParams ¶

type ExecutionParams struct {
	RunID           uuid.UUID
	NodeExecutionID uuid.UUID
	NodeID          uuid.UUID

	Image       string
	Command     []string
	Environment map[string]string

	JobSecret   string
	Credentials NodeCredentials

	ConfigJSON  map[string]any
	CallbackURL string

	EnableDocker bool
	// DindImage overrides the dind sidecar image for this launch (a per-project custom
	// image). Empty means use the executor's configured default.
	DindImage string
	Identity  ExecutionIdentity

	// AgentResources overrides the executor's default agent-container CPU/memory for this one
	// execution. Nil uses the deployment default (the K8s executor's Config).
	AgentResources *AgentResources
}

ExecutionParams describes one node execution to run.

type ExecutionResult ¶

type ExecutionResult struct {
	PodName       string
	JobSecretHash string
}

ExecutionResult is what Execute returns once a workload has been started.

type Executor ¶

type Executor interface {
	Execute(ctx context.Context, params ExecutionParams) (ExecutionResult, error)
	Cleanup(ctx context.Context, executionID uuid.UUID) error
	Terminate(ctx context.Context, executionID uuid.UUID) error
	GetLogs(ctx context.Context, executionID uuid.UUID, tailLines int) (string, error)
	ResolveJobSecretHash(ctx context.Context, runID, executionID uuid.UUID) (string, error)
	HealthCheck(ctx context.Context) error
}

Executor runs and manages the lifecycle of node execution workloads. Seam rationale: docs/decisions/2026-09-06---02-worker-placement-and-executor-seams.md.

Cleanup, Terminate, and GetLogs take only the executionID: an instance is namespace-bound at construction, so they address resources by deterministic name, never a cluster-wide LIST.

ResolveJobSecretHash additionally takes the runID because a Worker calls it from its HTTP callback server, where no Temporal activity context exists to derive the run; a multi-tenant overlay needs the runID to resolve the namespace, and a single-namespace instance ignores it.

type NodeCredentials ¶

type NodeCredentials struct {
	GitHubTokenURL   string
	ClaudeOAuthToken string
	Registry         *RegistryCredentials
}

NodeCredentials are the credentials injected into a node execution's workload.

type RegistryCredentials ¶

type RegistryCredentials struct {
	Host     string
	Username string
	Password string
}

RegistryCredentials authenticate a workload's image pull against a container registry.