Documentation
¶
Overview ¶
Package store provides the Redis client shared by nova-sprint verbs.
Index ¶
Constants ¶
const ( UserEnv = redisauth.UserEnv PasswordEnvEnv = redisauth.PasswordEnvEnv DefaultPasswordEnv = redisauth.DefaultPasswordEnv )
Fleet authentication. The fleet Redis (users.acl) has its default user off, so an unauthenticated verb fails NOAUTH. The password is never a flag: `nova-secrets exec --only NOVA_REDIS_BENCH_PASSWORD` leaves it in the environment, where a ps cannot read it (the nova-pulse convention). UserEnv names the ACL user and turns authentication on; PasswordEnvEnv names the variable holding that user's password, DefaultPasswordEnv when unset. With UserEnv unset, Open connects as before, so a throwaway test Redis and a bench that exports the bench password for other tools are unaffected; only when that unauthenticated connection is refused NOAUTH while the password is already in the environment does the refusal name the missing variable and the pair instead of passing the raw NOAUTH through. Open sends nothing, so that refusal is the first command's error.
Variables ¶
var ACLRules = []string{
"ns-friend resetkeys resetchannels -@all +ping +client|setname +client|id ~s:* ~bench:* ~friend:* ~machine:* ~lease:* ~proc:* ~cap:* ~ci:* ~sprints ~sprint:order ~benches ~friends ~friends:* ~task:* ~ws:* ~q:* ~sprint:* ~pr:* ~ref:* ~consumers ~readers %R~cfg:card +del +exists +hdel +hget +hgetall +hmget +hset +hincrby +lrange +lpos +pexpire +persist +pttl +rpush +sadd +scard +sismember +smembers +smove +srem +time +xack +xadd +zadd +zcard +zcount +zrange +zrem +zscore +fcall_ro|ns_snapshot +fcall_ro|ns_task_live +fcall_ro|ns_cell_zcard +fcall_ro|ns_cell_zrange +fcall|ns_ping +fcall|ns_health +fcall|ns_cm_work +fcall|ns_cm_beat +fcall|ns_cm_end +fcall|ns_cm_cancel +fcall|ns_task_take +fcall|ns_task_beat +fcall|ns_task_done +fcall|ns_friend_loop_claim +fcall|ns_friend_loop_renew +fcall|ns_friend_loop_release +fcall|ns_friend_models +fcall|ns_cm_owner (~friend:*:wake +blpop)",
"ns-bench resetkeys resetchannels -@all +ping +client|setname +client|id ~s:* ~bench:* ~friend:* ~machine:* ~lease:* ~proc:* ~cap:* ~ci:* ~sprints ~sprint:order ~benches ~friends ~friends:* ~task:* ~ws:* ~q:* ~sprint:* ~pr:* ~ref:* ~consumers ~readers %R~cfg:card +del +exists +hdel +hget +hgetall +hmget +hset +hincrby +hexists +lrange +lpos +pexpire +pttl +rpush +sadd +scard +sismember +smembers +smove +srem +time +xack +xadd +zadd +zcard +zcount +zrange +zrem +zscore +zmscore +xrevrange +fcall_ro|ns_snapshot +fcall_ro|ns_task_live +fcall|ns_ping +fcall|ns_health +fcall|ns_cm_work +fcall|ns_cm_beat +fcall|ns_cm_end +fcall|ns_cm_cancel +fcall|ns_bench_beat +fcall|ns_bench_release (+get +set ~bench:*:owner)",
"ns-reconciler resetkeys resetchannels -@all +ping +client|setname +client|id ~s:* ~bench:* ~friend:* ~machine:* ~lease:* ~proc:* ~cap:* ~ci:* ~sprints ~sprint:order ~benches ~friends ~friends:* +del +exists +hget +hgetall +hmget +hset +pexpire +pttl +sadd +scard +sismember +smembers +smove +srem +time +xack +xadd +zadd +zcard +zcount +zrange +zrem +zscore +fcall_ro|ns_snapshot +fcall_ro|ns_task_live +fcall|ns_ping +fcall|ns_health +fcall|ns_reconciler_acquire +fcall|ns_reconciler_renew +fcall|ns_reconciler_pass +fcall|ns_reconciler_release +fcall|ns_task_expire (~s:*:log ~cap:log +xreadgroup +xautoclaim +xpending)",
"ns-consumer resetkeys resetchannels -@all +ping +client|setname +client|id ~s:* ~bench:* ~friend:* ~machine:* ~lease:* ~proc:* ~cap:* ~ci:* ~sprints ~sprint:order ~sprint:epoch ~benches ~friends ~friends:* +del +exists +hget +hgetall +hmget +hset +pexpire +pttl +sadd +scard +sismember +smembers +smove +srem +time +xack +xadd +zadd +zcard +zcount +zrange +zrem +zscore +fcall_ro|ns_snapshot +fcall_ro|ns_task_live +fcall|ns_ping +fcall|ns_health +fcall|ns_task_push (~s:*:log ~cap:log +xreadgroup +xautoclaim +xpending)",
"ns-coordinator resetkeys resetchannels -@all +ping +client|setname +client|id ~s:* ~bench:* ~friend:* ~machine:* ~lease:* ~proc:* ~cap:* ~ci:* ~sprints ~sprint:order ~sprint:epoch ~ws:* ~benches ~friends ~friends:* ~table:* ~tables ~task:* ~view:* ~views +hdel +type +xinfo|stream +del +exists +hget +hgetall +hmget +hlen +hstrlen +hexists +hset +pexpire +pttl +sadd +scard +sismember +smembers +smove +srem +time +xack +xadd +zadd +zcard +zcount +zrange +zrem +zscore +zmscore +xrevrange +fcall_ro|ns_snapshot +fcall_ro|ns_task_live +fcall_ro|ns_ws_zrange +fcall|ns_ping +fcall|ns_health +fcall|ns_task_push +fcall|ns_task_cancel +fcall|ns_capacity_desired +fcall|ns_capacity_machine +fcall|ns_oset_move +fcall|ns_table_clear +rename +fcall|ns_table_set +fcall|ns_table_rows_add +fcall|ns_table_rows_hide +fcall|ns_view_set +fcall|ns_view_state +fcall|ns_view_del +fcall|ns_table_row_set +fcall|ns_table_create +fcall|ns_table_drop +fcall|ns_table_drop_definition +fcall|ns_table_member_create +fcall|ns_table_row_add +fcall|ns_table_row_del +fcall|ns_table_cell_add +fcall|ns_table_cell_remove +fcall|ns_table_cell_move +fcall|ns_table_bind +fcall|ns_table_apply +fcall_ro|ns_table_read +fcall_ro|ns_table_read_set +fcall_ro|ns_table_check +scan +fcall_ro|ns_table_list +fcall_ro|ns_view_get +fcall_ro|ns_view_list +fcall_ro|ns_table_member_find +fcall_ro|ns_table_members",
"ns-table resetkeys resetchannels -@all +ping +client|setname +client|id %R~s:* %R~bench:* %R~friend:* %R~machine:* %R~lease:* %R~proc:* %R~cap:* %R~ci:* %R~sprints %R~sprint:order %R~sprint:epoch %R~benches %R~friends %R~table:* %R~tables %R~view:* %R~views +exists +hget +hgetall +hmget +pttl +scard +sismember +smembers +time +zcard +zcount +zrange +zscore +zmscore +xrevrange +fcall_ro|ns_snapshot +fcall_ro|ns_table_read +fcall_ro|ns_table_read_set +fcall_ro|ns_table_list +fcall_ro|ns_view_get +fcall_ro|ns_view_list +fcall_ro|ns_table_member_find +fcall_ro|ns_table_members",
"ns-deploy resetkeys resetchannels -@all +ping +client|setname +client|id +function|load +function|list",
}
ACLRules are the baseline permissions for each actor in the fleet Redis. The bench and friend seats run consumer copies through the table moves (card work --fill, card beat, card end, and the session's give-back, card cancel), whose moves read and write task:*, ws:*, q:*, sprint:*, pr:* (a read's line on the PR record), consumers and readers, with HDEL, LPOS and RPUSH; the bench's copy ledger reads cfg:card (TestACLSeatsRunTheCardVerbs). Every reader of a table set keys it by the sprint epoch: the consumer, table and coordinator seats read sprint:epoch (the friend seat's ~sprint:* holds it), the friend seat's take and width count their working set through ns_cell_zcard, its beat reads the copies it holds through ns_cell_zrange, and the coordinator's lander reads its members through ns_ws_zrange under ~ws:*, as the live row has it (TestACLSeatsReadTheSprintEpoch). The friend seat also keeps its own beat (seat-keeps-beat: friend beat's HSET and PERSIST of friend:<f>:beat) and its one beat loop's lease and models through the ns_friend_loop_* and ns_friend_models functions, never SET or EVAL (TestFriendSeatKeepsBeatUnderACL). The tables of pkg/ntable (nova-table; the sprint's streams table) live under ~table:* with the registry set tables: the coordinator seat writes them (the plain writes plus the two functions, ns_oset_move and ns_table_clear; pkg/ntable's TestTableGrantsAreExactlyWhatTheWriterNeeds runs every write as a user holding exactly those) and the table seat reads them. A table's read set and batch check their members' places with one ZMSCORE per cell, and a sprint's twin catches a table up from its change stream with XREVRANGE (nova-sprint's tick, twin.go): the coordinator and bench seats hold both.
Functions ¶
func Auth ¶
Auth is the environment seat (pkg/nsprint/redisauth): user is the ACL user, else UserEnv; passwordEnv the variable holding its password, else PasswordEnvEnv, else DefaultPasswordEnv.
func NoUserHint ¶
func NoUserHint() string
NoUserHint is the NOAUTH refusal: password in the environment, ACL user unset.
Types ¶
type Store ¶
type Store struct {
// contains filtered or unexported fields
}
Store owns a Redis connection. Mutating verbs use FCALL through Client; batches of independent reads use PipelineHMGet.
func (*Store) CountTrips ¶
CountTrips attaches a round-trip counter to the store's client.
func (*Store) PipelineHMGet ¶
PipelineHMGet queues every read before Exec. Redis receives the full batch before reading any reply and returns replies in the same order. The buffered transport may split the batch into multiple writes, but it uses one exchange.
type Trips ¶
type Trips struct {
// contains filtered or unexported fields
}
Trips counts the network round trips a Store's client makes from the moment CountTrips attaches it: each single command is one, each pipeline Exec is one however many commands it carries. Verbs print the count on their receipt (`trips=<n>`) so a regression to serial reads shows in the output, not only in a test.
func (*Trips) ProcessHook ¶
func (t *Trips) ProcessHook(next redis.ProcessHook) redis.ProcessHook
ProcessHook counts one round trip per single command.
func (*Trips) ProcessPipelineHook ¶
func (t *Trips) ProcessPipelineHook(next redis.ProcessPipelineHook) redis.ProcessPipelineHook
ProcessPipelineHook counts one round trip per pipeline Exec.
Source Files