Documentation
¶
Overview ¶
Package state persists the snapshot that makes a fire reversible.
The ordering rule is absolute: the snapshot is written, and read back, before a single API call changes anything. If the write fails the fire is abandoned. An account that is still expensive is a problem; an account that is stopped with no record of how to start it is an outage of unknown length.
S3 is the intended home — it is in the never-touch set, so the kill switch cannot destroy its own restore — with a local copy alongside for the case where the reason you are firing is that something is wrong with the account.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrNotFound = errors.New("no snapshot with that plan id")
ErrNotFound is returned when a plan id has no snapshot. Callers match on it to tell "nothing to restore" from "the store is broken".
Functions ¶
Types ¶
type Local ¶
type Local struct{ Dir string }
Local is the on-disk store. It is always present, even when a durable store is configured: a laptop that loses its network mid-incident still has the record of what it stopped.
func (Local) Get ¶
Get reads one snapshot. A corrupt file is reported as corrupt rather than as missing: those need different reactions.
type Multi ¶
type Multi struct{ Stores []Store }
Multi writes to every store and requires all of them to succeed, so the local copy and the durable copy cannot disagree about what was stopped.
func (Multi) Describe ¶
Describe names every underlying store, so an error says which of them the run was actually talking to.
func (Multi) Get ¶
Get reads from the first store that has it. Order matters: the durable store should come first, since the local one may be on a machine that was rebuilt.
type S3 ¶
S3 is the durable home for snapshots.
S3 is in the never-touch set, which is not a coincidence: the kill switch must not be able to destroy its own restore record. Versioning on the bucket is worth turning on for the same reason.
func (S3) Describe ¶
Describe names this store in errors and in the warning printed when there is no durable one.
func (S3) Get ¶
Get reads one snapshot. A missing object and a denied one both come back as ErrNotFound: from a restore's point of view the record is not there.
type Store ¶
type Store interface {
Put(ctx context.Context, s model.Snapshot) error
Get(ctx context.Context, planID string) (model.Snapshot, error)
List(ctx context.Context) ([]model.Snapshot, error)
Describe() string
}
Store is where the record that makes a fire reversible lives. Every implementation must survive the machine that wrote it: a restore usually happens somewhere else, later, under pressure.
func Build ¶ added in v1.10.0
Build assembles the store a run should use: the durable one first, so a rebuilt laptop still finds the record, with the local directory behind it.
localDir may be empty, which is the Lambda's case — there is no durable filesystem there, and a local copy that dies with the execution environment would be a restore record that does not exist.
Source Files