Help us shape the future of Go! Take the 2026 Go Developer Survey

fleet

package
v4.0.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 22, 2026 License: MIT Imports: 13 Imported by: 0

Documentation

Overview

Package fleet models reported worker liveness and protocol/capability compatibility without supervising processes or implementing delivery. NewRegistry retains copied reports under one mutex; NewProjection aggregates lifecycle events with a cardinality overflow bucket. Neither authenticates reports, persists state, starts a polling loop or owns provider shutdown.

Index

Constants

View Source
const (
	// MaxIdentityBytes bounds worker status labels.
	MaxIdentityBytes = 256
	// MaxQueuesPerWorker bounds one heartbeat's queue cardinality.
	MaxQueuesPerWorker = 256
	// MaxCapabilitiesPerWorker bounds negotiated capability cardinality.
	MaxCapabilitiesPerWorker = 64
	// MaxWorkerConcurrency bounds reported goroutine concurrency.
	MaxWorkerConcurrency = 1_000_000
)

Variables

View Source
var ErrInvalidTelemetryConfiguration = errors.New("fleet: invalid telemetry configuration")

ErrInvalidTelemetryConfiguration reports unusable fleet metric settings.

Functions

This section is empty.

Types

type Capability

type Capability string

Capability identifies one advertised data-plane management operation. Negotiation enables a shared capability but does not grant authorization.

const (
	// CapabilityWorkerStatus advertises worker-status reads.
	CapabilityWorkerStatus Capability = "worker_status"
	// CapabilityQueueStatus advertises queue-status reads.
	CapabilityQueueStatus Capability = "queue_status"
	// CapabilityPause advertises paused admission.
	CapabilityPause Capability = "pause"
	// CapabilityResume advertises resumed admission.
	CapabilityResume Capability = "resume"
	// CapabilityDrain advertises worker draining.
	CapabilityDrain Capability = "drain"
	// CapabilityTerminate advertises worker termination.
	CapabilityTerminate Capability = "terminate"
	// CapabilityFailures advertises failure-record access.
	CapabilityFailures Capability = "failures"
	// CapabilityDeadLetters advertises dead-letter access.
	CapabilityDeadLetters Capability = "dead_letters"
	// CapabilityRetry advertises single-record retry.
	CapabilityRetry Capability = "retry"
	// CapabilityBulkRetry advertises bounded bulk retries.
	CapabilityBulkRetry Capability = "bulk_retry"
	// CapabilityDelete advertises record deletion.
	CapabilityDelete Capability = "delete"
	// CapabilityPurge advertises confirmed purging.
	CapabilityPurge Capability = "purge"
	// CapabilityReplay advertises record replay.
	CapabilityReplay Capability = "replay"
	// CapabilityRetentionCount advertises count-based retention.
	CapabilityRetentionCount Capability = "retention_count"
	// CapabilityRetentionTime advertises time-based retention.
	CapabilityRetentionTime Capability = "retention_time"
	// CapabilityRetentionBytes advertises byte-based retention.
	CapabilityRetentionBytes Capability = "retention_bytes"
)

type Compatibility

type Compatibility struct {
	// State is version compatibility, not authenticated worker identity or
	// liveness.
	State CompatibilityState `json:"state"`
	// Enabled is a newly owned sorted intersection, empty unless versions are
	// compatible.
	Enabled []Capability `json:"enabled"`
	// WorkerOnly is a newly owned sorted set absent from control-plane
	// capabilities.
	WorkerOnly []Capability `json:"worker_only"`
	// ControlPlaneOnly is a newly owned sorted set absent from worker
	// capabilities.
	ControlPlaneOnly []Capability `json:"control_plane_only"`
}

Compatibility is the deterministic result of protocol and capability negotiation.

func Negotiate

func Negotiate(
	supported ProtocolRange,
	worker ProtocolVersion,
	workerCapabilities []Capability,
	controlPlaneCapabilities []Capability,
) Compatibility

Negotiate safely compares a worker report with the control-plane range and enables only capabilities both sides support at a compatible version.

type CompatibilityState

type CompatibilityState string

CompatibilityState describes a worker relative to the supported protocol range without pretending an incompatible worker is controllable.

const (
	// CompatibilityCompatible means the reported version lies in the supported
	// inclusive range.
	CompatibilityCompatible CompatibilityState = "compatible"
	// CompatibilityWorkerOlder means the worker is below the minimum supported
	// version.
	CompatibilityWorkerOlder CompatibilityState = "worker_older"
	// CompatibilityWorkerNewer means the worker exceeds the maximum supported
	// version.
	CompatibilityWorkerNewer CompatibilityState = "worker_newer"
	// CompatibilityUnknown means the range is inverted or the worker supplied a
	// zero version.
	CompatibilityUnknown CompatibilityState = "unknown"
)

type DrainState

type DrainState string

DrainState describes progress of a graceful drain request.

const (
	// DrainNotRequested reports no requested drain.
	DrainNotRequested DrainState = "not_requested"
	// DrainRequested reports acceptance of a drain request.
	DrainRequested DrainState = "requested"
	// DrainInProgress reports active drain work.
	DrainInProgress DrainState = "in_progress"
	// DrainCompleted reports completed draining.
	DrainCompleted DrainState = "completed"
	// DrainTimedOut reports an expired drain.
	DrainTimedOut DrainState = "timed_out"
)

type Heartbeat

type Heartbeat struct {
	// TenantID is required bounded tenant scope; the reporting/authentication
	// boundary must bind it.
	TenantID string
	// WorkerID is required bounded worker identity, paired with TenantID in
	// Registry.
	WorkerID string
	// Version is required bounded implementation version text, not the
	// management Protocol.
	Version string
	// StartedAt is required worker start time and must not follow ObservedAt.
	StartedAt time.Time
	// ObservedAt is required observation time used for ordering and staleness;
	// source adapters choose its clock authority.
	ObservedAt time.Time
	// Queues contains at most MaxQueuesPerWorker bounded names; Registry copies
	// the slice.
	Queues []string
	// Concurrency must be positive and at most MaxWorkerConcurrency.
	Concurrency uint32
	// State must be a reported running/paused/draining/stopped state; derived
	// stale/unknown values are rejected.
	State State
	// CurrentJobs must not exceed Concurrency.
	CurrentJobs uint32
	// DrainStatus must be one supported reported drain state.
	DrainStatus DrainState
	// Backend is required bounded backend attribution.
	Backend string
	// Protocol must be a nonzero version pair; this is a report, not
	// conformance proof.
	Protocol ProtocolVersion
	// Capabilities contains at most MaxCapabilitiesPerWorker bounded capability
	// names; Registry copies the slice.
	Capabilities []Capability
}

Heartbeat is the latest status reported by a worker.

func (Heartbeat) EffectiveState

func (h Heartbeat) EffectiveState(now time.Time, staleAfter time.Duration) State

EffectiveState classifies observation time and reported state at now. Missing or future times and unsupported states are unknown; this method does not run full Heartbeat.Validate. Callers should supply a positive staleAfter.

func (Heartbeat) Validate

func (h Heartbeat) Validate() error

Validate rejects malformed or unbounded worker status reports.

type HeartbeatDisposition

type HeartbeatDisposition string

HeartbeatDisposition describes how the registry handled one report.

const (
	// HeartbeatAccepted retains a copied new or later validated heartbeat.
	HeartbeatAccepted HeartbeatDisposition = "accepted"
	// HeartbeatDuplicate leaves an identical same-time report unchanged.
	HeartbeatDuplicate HeartbeatDisposition = "duplicate"
	// HeartbeatReordered ignores an older observation.
	HeartbeatReordered HeartbeatDisposition = "reordered"
	// HeartbeatConflict marks same-time conflicting reports unknown until a
	// later valid report arrives.
	HeartbeatConflict HeartbeatDisposition = "conflict"
	// HeartbeatInvalid refuses a malformed report without retaining it.
	HeartbeatInvalid HeartbeatDisposition = "invalid"
	// HeartbeatCapacityExceeded refuses a new worker identity at capacity and
	// increments the global count and any registered tenant detail.
	HeartbeatCapacityExceeded HeartbeatDisposition = "capacity_exceeded"
)

type HeartbeatValidationError

type HeartbeatValidationError struct {
	// Field names the invalid boundary and is printed by Error.
	Field string
	// Problem is printed by Error; producers should supply rule text, not
	// sensitive rejected values.
	Problem string
}

HeartbeatValidationError identifies one invalid worker-status field.

func (*HeartbeatValidationError) Error

func (e *HeartbeatValidationError) Error() string

Error prints the field and rule text, not the rejected heartbeat values.

type Projection

type Projection struct {
	// contains filtered or unexported fields
}

Projection consumes queue lifecycle events without accessing a backend. New queue identities beyond the configured limit are aggregated into the overflow bucket to bound retained identity cardinality. Event label bytes and numeric overflow are not separately constrained; callers own trusted input. Construct with NewProjection and do not copy after the mutex is used.

func NewProjection

func NewProjection(maxQueues int) *Projection

NewProjection creates a projection that retains at most maxQueues distinct queue identities. Non-positive limits retain no identities and aggregate all events into the overflow bucket.

func (*Projection) Observe

func (p *Projection) Observe(event queue.Event)

Observe implements queue.Observer.

func (*Projection) Snapshot

func (p *Projection) Snapshot() ProjectionSnapshot

Snapshot returns a deterministic copy safe for concurrent readers.

type ProjectionSnapshot

type ProjectionSnapshot struct {
	// Queues is a newly owned backend/queue-sorted slice; caller mutation does
	// not alter Projection.
	Queues []QueueSnapshot
	// Overflow aggregates events for identities refused at the configured
	// cardinality limit.
	Overflow QueueMetrics
}

ProjectionSnapshot is an independently owned point-in-time fleet projection.

type ProtocolRange

type ProtocolRange struct {
	// Minimum is the inclusive lower version; an inverted range yields
	// CompatibilityUnknown.
	Minimum ProtocolVersion
	// Maximum is the inclusive upper version.
	Maximum ProtocolVersion
}

ProtocolRange is the inclusive protocol range supported by the control plane during rolling upgrades.

type ProtocolVersion

type ProtocolVersion struct {
	// Major is the reported major version; this model compares the complete
	// nonzero pair rather than validating a universal protocol edition.
	Major uint16 `json:"major"`
	// Minor is the reported minor version used in lexicographic range
	// comparison.
	Minor uint16 `json:"minor"`
}

ProtocolVersion identifies a worker/control-plane management protocol.

type QueueMetrics

type QueueMetrics struct {
	// Enqueued counts observed EventEnqueued events since construction.
	Enqueued uint64
	// Succeeded counts observed successful handler events, not durable
	// settlement.
	Succeeded uint64
	// Failed counts observed failed handler events.
	Failed uint64
	// Runtime accumulates handler success/failure durations; it is not a per-job average.
	Runtime time.Duration
}

QueueMetrics is a bounded current-state projection of lifecycle events. Runtime is cumulative so a metrics backend can derive honest averages and rates without this package retaining an unbounded time series.

type QueueSnapshot

type QueueSnapshot struct {
	// Backend identifies the event source backend, not a connection handle.
	Backend string
	// Queue identifies the event-reported queue.
	Queue string
	// Metrics contains copied cumulative counters for this identity.
	Metrics QueueMetrics
}

QueueSnapshot identifies one queue's current projected counters.

type Registry

type Registry struct {
	// contains filtered or unexported fields
}

Registry synchronizes a bounded set of latest copied worker heartbeats. Construct with NewRegistry and do not copy after use. There is no eviction or close operation. Rejection detail belongs only to successfully registered tenants, so retained detail cardinality cannot exceed maxWorkers. Refused unknown tenants contribute only to the exact global count.

func NewRegistry

func NewRegistry(maxWorkers int) *Registry

NewRegistry creates a registry that retains at most maxWorkers identities.

func (*Registry) RegisterTelemetry

func (r *Registry) RegisterTelemetry(
	meter metric.Meter,
	now func() time.Time,
	staleAfter time.Duration,
) (metric.Registration, error)

RegisterTelemetry exports fixed-cardinality fleet state and rejection measurements. The caller owns the returned registration lifecycle.

func (*Registry) Snapshot

func (r *Registry) Snapshot(now time.Time, staleAfter time.Duration) RegistrySnapshot

Snapshot returns sorted workers with liveness derived at now.

func (*Registry) SnapshotTenant

func (r *Registry) SnapshotTenant(
	tenant string,
	now time.Time,
	staleAfter time.Duration,
) RegistrySnapshot

SnapshotTenant returns only one tenant's workers and available rejection detail. An unregistered tenant has RejectedKnown=false and Rejected=0; that zero is not an assertion that no heartbeat was refused.

func (*Registry) Upsert

func (r *Registry) Upsert(heartbeat Heartbeat) HeartbeatDisposition

Upsert ingests one heartbeat without allowing delayed, duplicate, or conflicting reports to falsely advance worker state.

type RegistrySnapshot

type RegistrySnapshot struct {
	// Workers is a newly owned tenant/worker-sorted slice with copied
	// queue/capability slices.
	Workers []WorkerSnapshot
	// Rejected counts capacity refusals when RejectedKnown is true.
	Rejected uint64
	// RejectedKnown distinguishes exact counts from unavailable tenant detail.
	// Whole-registry counts are always known; tenant counts are known only for
	// tenants with a successfully registered worker.
	RejectedKnown bool
}

RegistrySnapshot is a deterministic point-in-time view of retained workers.

type State

type State string

State is the worker state reported to administrative consumers.

const (
	// StateRunning is a reported worker processing state, not an externally
	// verified health guarantee.
	StateRunning State = "running"
	// StatePaused is a reported admission pause; active work may remain.
	StatePaused State = "paused"
	// StateDraining is a reported drain in progress.
	StateDraining State = "draining"
	// StateStopped is a reported stopped worker.
	StateStopped State = "stopped"
	// StateStale is derived when observation is at or before the staleness
	// cutoff; workers may not report it.
	StateStale State = "stale"
	// StateUnknown is derived for missing/future/unsupported status or registry
	// conflicts; workers may not report it.
	StateUnknown State = "unknown"
)

type WorkerSnapshot

type WorkerSnapshot struct {
	Heartbeat
	// State is derived liveness/conflict state, shadowing the embedded reported
	// State.
	State State
}

WorkerSnapshot contains a defensively copied heartbeat and its derived fail-safe state.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL