Documentation
¶
Overview ¶
Package rendergate runs the controller's own `haproxy -c` over each render, off the reconcile wall clock.
The reconcile pipeline renders and dispatches; this component decides afterwards whether HAProxy would load what was dispatched. It is a two-state latch (ADR-0022):
- OPTIMISTIC (default): renders dispatch immediately. A pass names the plan agents may promote their rollback baseline to; a refusal reverts the pods that took the bad plan without loading it and flips the latch.
- PESSIMISTIC: the scheduler holds every render until this gate passes one. A pass releases it and returns to OPTIMISTIC; a refusal pins the fleet on the last config it accepted.
Coverage is the same as the synchronous check it replaces. What changes is when it runs: while OPTIMISTIC the exposure window is one check plus one apply, closed by the scoped revert and the latch.
Index ¶
- Constants
- type Checker
- type Component
- type Config
- type OutputChecker
- type ServiceChecker
- func (s ServiceChecker) Check(ctx context.Context, config string, auxFiles *dataplane.AuxiliaryFiles, ...) error
- func (s ServiceChecker) CheckOutput(ctx context.Context, snapshot *renderoutput.Snapshot, checksum string) error
- func (s ServiceChecker) CheckSnapshot(ctx context.Context, config string, snapshot *renderartifact.Snapshot, ...) error
- type SnapshotChecker
Constants ¶
const ( // ComponentName is the unique identifier for this component. ComponentName = "rendergate" // EventBufferSize is the size of the event subscription buffer. Renders // arrive at most one per reconcile; pod ACKs are the higher-volume input. EventBufferSize = busevents.StandardSubscriberBuffer )
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Checker ¶
type Checker interface {
Check(ctx context.Context, config string, auxFiles *dataplane.AuxiliaryFiles, checksum string) error
}
Checker runs the controller's own `haproxy -c` over one rendered file set. A nil error is a pass; dataplane.ErrHAProxyRefused in the chain means HAProxy judged the config, anything else means the check could not run.
type Component ¶
type Component struct {
*component.ReadySignal
// contains filtered or unexported fields
}
Component is the render gate's event adapter.
Event subscriptions:
- TemplateRenderedEvent: the render to check (always coalesced to newest)
- ConfigAppliedToPodEvent: which plan each pod holds, so a superseded plan that pods still run is checked too
- HAProxyPodTerminatedEvent / HAProxyPodsDiscoveredEvent: prune that map
- LostLeadershipEvent: drop the latch and the fleet's plans
It publishes RenderGateCompletedEvent.
func New ¶
New creates the render gate.
It does NOT subscribe here: two of its inputs (pod discovery, pod termination) are published on every replica, so a construction-time subscription would fill a channel nobody drains on the standby and be reported as critical drops. Start subscribes once leadership is held.
func (*Component) HealthCheck ¶
HealthCheck implements lifecycle.HealthChecker.
func (*Component) Logger ¶
Logger exposes the component's logger, matching the other components' shape.
type Config ¶
type Config struct {
EventBus *busevents.EventBus
Logger *slog.Logger
Checker Checker
// Metrics records the rejection counter and the pinned gauge. Nil in tests.
Metrics *metrics.Metrics
// CheckTimeout bounds one check. Zero uses validation.DefaultValidationTimeout.
CheckTimeout time.Duration
}
Config contains the dependencies for the render gate.
type OutputChecker ¶
type OutputChecker interface {
CheckOutput(ctx context.Context, snapshot *renderoutput.Snapshot, checksum string) error
}
OutputChecker validates one authenticated complete render output directly.
type ServiceChecker ¶
type ServiceChecker struct {
Service *validation.ValidationService
}
ServiceChecker adapts a validation.ValidationService to Checker.
func (ServiceChecker) Check ¶
func (s ServiceChecker) Check(ctx context.Context, config string, auxFiles *dataplane.AuxiliaryFiles, checksum string) error
Check runs the service's `haproxy -c` and returns its error unchanged, so the caller can tell HAProxy's verdict from a check that could not run.
func (ServiceChecker) CheckOutput ¶
func (s ServiceChecker) CheckOutput( ctx context.Context, snapshot *renderoutput.Snapshot, checksum string, ) error
CheckOutput validates a complete immutable render output without splitting its identity.
func (ServiceChecker) CheckSnapshot ¶
func (s ServiceChecker) CheckSnapshot( ctx context.Context, config string, snapshot *renderartifact.Snapshot, checksum string, ) error
CheckSnapshot validates authenticated immutable auxiliary output.
type SnapshotChecker ¶
type SnapshotChecker interface {
CheckSnapshot(ctx context.Context, config string, snapshot *renderartifact.Snapshot, checksum string) error
}
SnapshotChecker validates authenticated immutable auxiliary output directly.
Source Files