funcd

package
v0.13.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 13, 2026 License: Apache-2.0 Imports: 95 Imported by: 0

Documentation

Overview

Package funcd is the platform-as-a-library facade (ADR-0014): the composition root that wires every port into a *Platform and owns its start/stop lifecycle. Run serves the control-plane API and runs the controller (ADR-0028); cmd/funcd is a thin shell over it; e2e tests embed it with the InMemory() preset — no daemon, no root, no network beyond the ephemeral control-plane listener.

Index

Constants

View Source 
const DevToken = "funcd-dev-token"

DevToken is the default control-plane credential token wired by InMemory(). It lets a test/tool authenticate against an embedded platform; it is NOT a production identity story (Production() wires no default token — ADR-0028).

Variables

This section is empty.

Functions

func DefaultLivenessTimeout added in v0.11.0 

func DefaultLivenessTimeout(supervisionPeriod time.Duration) time.Duration

DefaultLivenessTimeout is runtime.livenessTimeout's default for a supervision period (ADR-0215): max(30s, three periods), saturating.

Types

type Credential added in v0.4.0 

type Credential struct {
	Token      string
	Role       string
	Namespaces []string
}

Credential is one static control-plane and edge token (ADR-0171): Role is "admin", "developer" or "viewer"; Namespaces scopes a developer or viewer (at least one) and is empty for an admin.

type LogLine 

type LogLine struct {
	Namespace  string
	Function   string
	Replica    string
	Invocation string            // per-invocation id (may be empty for pre-invocation lines)
	Time       time.Time         // real event time
	Severity   string            // TRACE | DEBUG | INFO | WARN | ERROR | FATAL
	Body       string            // the log message
	Attrs      map[string]string // structured attributes
}

LogLine is one structured function-log record surfaced to a LogObserver — a stable projection of the internal funclog Entry, so the public option leaks no internal type. Attrs is read-only.

type LogObserver 

type LogObserver func(LogLine)

LogObserver receives every captured function log line as it happens, IN ADDITION to the normal blob-persisted capture. `funcdctl dev` uses it to stream logs to the terminal in real time. It runs on the log-routing goroutine and must not block.

type Option 

type Option func(*config) error

Option configures the platform. Each With* function returns an Option that injects one dependency. Options are validated by New before the platform is returned (ADR-0002 functional-options facade).

func InMemory 

func InMemory() Option

InMemory returns an Option that wires the real in-memory drivers for every port — memory store, gocloud mem bucket, embedded memory-storage NATS, process runtime, embedded reverse-proxy gateway, a stdout text logger, and the no-op telemetry pipeline. No root, no containerd, no network: the e2e-harness preset every later feature embeds. Drivers that need a context at construction use context.Background() (the facade's New is ctx-free, ADR-0002/ADR-0014); they are released by Shutdown.

func Production 

func Production() Option

Production returns an Option that wires the pure-Go production drivers that do NOT vary by deployment: the embedded reverse-proxy gateway, a JSON logger, and the no-op telemetry pipeline (an OTLP endpoint is supplied via WithTelemetry when configured), plus the public control-plane bind, RBAC, and deliberately NO default credential. The **store** (badger, pure-Go, ADR-0065), **runtime** (containerd, Linux), and **blob + bus** (file vs memory — the daemon's `--memory` substrate choice, ADR-0043) are deployment-injected via WithStore / WithRuntime / WithBlob / WithBus — so Production() is composed as funcd.New(funcd.Production(), WithBlob(...), WithBus(...), WithStore(...), WithRuntime(...)).

func WithAppRevisionHistory added in v0.9.0 

func WithAppRevisionHistory(n int) Option

WithAppRevisionHistory sets app.revisionHistory (ADR-0200 Decision 8): the AppRevisions an App keeps besides its current one. Outside 1..100 ⇒ fault.Invalid from New. Without it the App reconciler keeps 10.

func WithArtifactStore 

func WithArtifactStore(dir string) Option

WithArtifactStore enables the OCI artifact Materializer (ADR-0031): functions are pulled by digest from their `spec.image` into a per-digest cache under dir. When a runtime shim is configured and no explicit Materializer is set, this selects the oras driver over the local-file stand-in.

func WithAuthorizer 

func WithAuthorizer(a auth.Authorizer) Option

WithAuthorizer injects the authorization PDP. Defaults to rbac.New().

func WithBackupParent added in v0.11.0 

func WithBackupParent(p *backup.GenRef) Option

WithBackupParent is the generation a restore loaded while the metastore is on the timeline that restore minted (restore.Parent, ADR-0206): the platform backup writes it as each generation's parent (ADR-0205 Inputs.Parent). nil ⇒ none.

func WithBlob 

func WithBlob(b blob.Bucket) Option

WithBlob injects the blob (storage layer) port.

func WithBlobPollInterval 

func WithBlobPollInterval(d time.Duration) Option

WithBlobPollInterval sets the platform-wide cadence at which a `blob:` EventSource's prefixes are List-polled for new objects (ADR-0119, F83). A duration ≤ 0 ⇒ the 15s default. One cadence for all blob sources in V1 (a per-source override is an open question).

func WithBlobStoreURL added in v0.11.0 

func WithBlobStoreURL(url string) Option

WithBlobStoreURL names the blob store's URL, blob.target or the file:// URL of blob.dir (ADR-0222 Decision 6): a BackupSchedule whose target is inside it is refused, one on its provider is Ready with reason SameProvider. Absent ⇒ targets are compared with nothing.

func WithBootBackoff added in v0.4.0 

func WithBootBackoff(initial, limit time.Duration) Option

WithBootBackoff sets runtime.bootBackoffInitial and runtime.bootBackoffMax (ADR-0160): a worker that crashed while booting is created again after initial, doubling per crash in a row up to limit. 0 ⇒ 10s and max(5m, initial); negative, or a set limit below initial ⇒ fault.Invalid from New.

func WithBridgeAddress added in v0.13.0 

func WithBridgeAddress(addr netip.Addr) Option

WithBridgeAddress sets funcd's address on its container bridge (ADR-0238): the catalog proxies and the SQL change feed bind and publish it, so a worker or an engine in its own netns reaches them. Unset ⇒ 127.0.0.1, where the daemon and the workers share the loopback (the process runtime, funcdctl dev).

func WithBus 

func WithBus(b bus.Bus) Option

WithBus injects the messaging port.

func WithCatalogExtensionDir 

func WithCatalogExtensionDir(dir string) Option

WithCatalogExtensionDir points catalog-consumer functions at a local DuckDB extension directory, injected into their worker env as DUCKDB_EXTENSION_DIRECTORY so a handler's `LOAD quack`/`ducklake` resolves the curated extensions. It is the `funcdctl dev` (ADR-0125) analogue of the prod bundle's duckdb-ext (ADR-0089): dev extracts the embedded catalog engine's extensions once and points consumers at them, since a dev handler runs from source with no bundle. Empty ⇒ no injection (prod).

func WithCatalogProviderRuntime 

func WithCatalogProviderRuntime(r provider.Runtime) Option

WithCatalogProviderRuntime overrides the CatalogService add-on-provider runtime (ADR-0087). The production runtime supervises the curated duckdb CONTAINER image; `funcdctl dev` (ADR-0125) injects a process-mode driver that runs the embedded DuckDB+Quack engine as a host subprocess, since process-dev runs no containers.

func WithContainerExecution 

func WithContainerExecution(imageFor func(runtime string) string) Option

WithContainerExecution enables curated-image container execution (ADR-0032): functions run in the containerd worker from the image imageFor(fn.Spec.Runtime) returns, with the shim as the image entrypoint, the artifact bind-mounted, and a fixed netns port. Used with the containerd runtime driver (prod); WithRuntimeShim is the process-driver path. Every function runs solo in its own worker: New refuses WithPoolShim or WithPoolShimFor with it (ADR-0173).

func WithCredentials added in v0.4.0 

func WithCredentials(creds ...Credential) Option

WithCredentials builds the one credential store both PEPs read (ADR-0171 Decision 5), replacing any earlier store (InMemory's dev token included); a later InMemory() or WithDevAuth replaces it, so apply it after the preset. Entry i gets Subject "credentials[i]". Errors name the index, never the token.

func WithDataPlaneAddr 

func WithDataPlaneAddr(addr string) Option

WithDataPlaneAddr sets the data-plane (function-invocation) listen address (ADR-0033). Default is 0.0.0.0:8081 (Production); InMemory() uses an ephemeral 127.0.0.1:0.

func WithDeadLetterQueue 

func WithDeadLetterQueue(dataDir string, deliveryAttempts int, retention time.Duration, maxEntries int) Option

WithDeadLetterQueue tunes the eventing DLQ + bounded action-delivery retry (ADR-0118, F85). The DLQ is always wired; without this option it runs in memory with the daemon config's defaults (720h retention, a per-namespace cap of 1000, three delivery attempts). This option sets its persistence + tunables: dataDir is the event store's Badger directory, holding the dead letters and the blob seen lists (ADR-0201; empty ⇒ in-memory, the InMemory-preset / memory-storage path), deliveryAttempts is the bounded-retry cap before a failed workflow:/function: delivery is dead-lettered (< 1 ⇒ 3), retention is how long parked entries survive the periodic sweep (0 ⇒ never), and maxEntries is the per-namespace count cap (0 ⇒ unbounded). cmd/funcd derives dataDir as <dataDir>/deadletter from config.

func WithDefaultInvokeTimeout added in v0.4.0 

func WithDefaultInvokeTimeout(d time.Duration) Option

WithDefaultInvokeTimeout sets invoke.defaultTimeout (ADR-0151): how long an external invoke waits for its response to start when the Function sets no spec.timeout. 0 ⇒ v1.DefaultInvokeTimeout (60s); negative or over v1.MaxInvokeTimeout (1h) ⇒ fault.Invalid from New. Links and workflow steps keep their own limits.

func WithDevAuth 

func WithDevAuth(token string, namespaces ...string) Option

WithDevAuth wires a single developer-role credential for token, scoped to the given namespaces (ADR-0028), replacing any earlier credential store. It is the dev/test shorthand; WithCredentials lists several tokens with roles (ADR-0171). It lets a public-surface caller authenticate without importing internal/auth. InMemory() applies a default (DevToken in "default"); Production() sets none (the operator supplies WithCredentials or WithDevAuth).

func WithEdgeAuth 

func WithEdgeAuth() Option

WithEdgeAuth enables the edge authn PEP (ADR-0113, F77) on the data plane: for a target whose stance is `authenticated`, the caller's bearer is authenticated (reusing the control-plane credentials) and the decision delegated to the authorizer, rejecting 401/403 before the activator. Without it, an `authenticated` stance fails closed (401); `open` targets are unaffected.

func WithEdgeObservability 

func WithEdgeObservability(cfg observ.Config) Option

WithEdgeObservability enables edge observability (ADR-0114, F76): RED metrics + an edge trace span (traceparent) + an access log. Uses the injected Telemetry (no-op by default). Zero Config ⇒ off.

func WithEdgeShaping 

func WithEdgeShaping(cfg shape.Config) Option

WithEdgeShaping enables edge shaping (ADR-0114, F78): CORS, response header inject/strip, and gzip compression (skipping streaming/upgrades). Zero Config ⇒ off (pass-through).

func WithEgressGateway 

func WithEgressGateway(gatewayPort, dnsForwarderPort uint16, dnsUpstream netip.AddrPort) Option

WithEgressGateway wires the ADR-0117 (F81) transparent egress PEP + DNS forwarder: when enabled on Linux, funcd starts a gateway on gatewayPort (F80's REDIRECT target) that authorizes every outbound worker connection against its namespace's EgressPolicy via the cedar PDP (egress::connect over a forwarder-attested NetDestination), and a DNS forwarder on dnsForwarderPort (the domain trust anchor + the only reachable resolver). dnsUpstream is the node resolver the forwarder forwards to. Disabled or non-Linux ⇒ no-op (egress open). Pairs with WithEgressIsolation (same server.network.egress flag).

func WithEgressIsolation 

func WithEgressIsolation(mgr network.Manager, p network.Policy) Option

WithEgressIsolation enables the worker network-isolation substrate (ADR-0115, FEAT-0007/F80): funcd programs an nftables policy (over the funcd0 CNI bridge) that default-denies worker egress and redirects remaining external TCP into the egress gateway (F81). mgr is the platform-specific Manager (network.New — a no-op when disabled or non-Linux); p is the ruleset frame. Applied at Run start (before workers serve), removed at Shutdown.

func WithEphemeralProviderStorage added in v0.13.0 

func WithEphemeralProviderStorage() Option

WithEphemeralProviderStorage marks the storage root of WithProviderStorage as one that does not outlive the daemon (storage.mode memory), so a SQL database never reports DataMissing (ADR-0234 Decision 6).

func WithFunclog 

func WithFunclog(segmentMaxAge time.Duration, segmentMaxBytes int) Option

WithFunclog tunes structured function-log capture (ADR-0081): the segment seal age and size (either 0 keeps the sink default — 10s / 8 MiB). Capture is on by default when the runtime supports it; use WithoutFunclog to disable.

func WithFunclogMaxRecordBytes added in v0.6.0 

func WithFunclogMaxRecordBytes(n int) Option

WithFunclogMaxRecordBytes bounds one shim log or span record line (ADR-0168), passed to every shim and pool host as FUNCD_FUNCLOG_MAX_RECORD_BYTES. 0 keeps the default (funclog.DefaultMaxRecordBytes); New refuses a nonzero value below 1024 or above funclog.MaxLineBytes, the reader's cap.

func WithGCSweepInterval added in v0.4.0 

func WithGCSweepInterval(d time.Duration) Option

WithGCSweepInterval sets the owner garbage collector's sweep period (ADR-0170, config controller.gcSweepInterval); not the stores' WithValueLogGCInterval. 0 ⇒ gc.DefaultInterval (5m).

func WithGateway 

func WithGateway(g gateway.Gateway) Option

WithGateway injects the ingress / API gateway port.

func WithHold added in v0.11.0 

func WithHold(h *hold.Hold) Option

WithHold hands the platform the hold cmd/funcd opened (hold.Open, ADR-0206 Decision 6): while it is held every side-effect runner stays still, and POST …/hold/release lifts it. Absent ⇒ never held.

func WithInvokeSocketDir 

func WithInvokeSocketDir(dir string) Option

WithInvokeSocketDir sets the directory for the per-function worker-node local API sockets (ADR-0064, fn-to-fn invoke). cmd/funcd sets it to <dataDir>/invoke from config; unset (InMemory()/tests) ⇒ a temp dir. New fails with fault.Invalid when the dir is too long for a Unix socket path.

func WithKVStore 

func WithKVStore(kv kvstore.KV) Option

WithKVStore injects the function-facing KV driver (ADR-0066/0069). Absent ⇒ the in-memory driver.

func WithKVStoreQuota 

func WithKVStoreQuota(maxPerNamespace int) Option

WithKVStoreQuota sets the per-namespace KVStore count cap enforced at admission (ADR-0072, kvstore.maxStoresPerNamespace). 0 ⇒ the default (100); a negative value disables the quota.

func WithLimits 

func WithLimits(cfg limit.Config) Option

WithLimits enables the ingress-protection middleware (ADR-0112, F75) on the data-plane chain: a token-bucket rate limit (429), a Content-Length body-size cap (413), and an in-flight concurrency ceiling (503), all rejecting BEFORE the activator (zero wake). A zero Config is a pass-through.

func WithListenAddr 

func WithListenAddr(addr string) Option

WithListenAddr sets the control-plane bind address (host:port). Default is the preset's (InMemory: an ephemeral "127.0.0.1:0"; Production: "0.0.0.0:8080").

func WithLogCompaction 

func WithLogCompaction(window, interval, retention time.Duration) Option

WithLogCompaction tunes function-log compacted compaction (ADR-0083): the window (bucket size + close threshold), the pass interval, and the compacted retention. A zero window/interval keeps the default (1h / 5m); retention <= 0 keeps compacted forever. Compaction is on by default when a blob substrate is present; use WithoutLogCompaction to disable.

func WithLogObserver 

func WithLogObserver(obs LogObserver) Option

WithLogObserver streams every captured function log line to obs as it happens, in addition to the normal blob-persisted capture — `funcdctl dev` uses it to print logs to the terminal in real time. obs runs on the log-routing goroutine and must not block.

func WithLogger 

func WithLogger(l *slog.Logger) Option

WithLogger injects the root logger, used exactly as given unless WithNormalizedLogFields is set. If not set, a stdout text logger is built.

func WithMasterLocation added in v0.11.0 

func WithMasterLocation(masterSecretFile, dataDir string) Option

WithMasterLocation sets where the node master secret lives, gateway on or off (ADR-0204 Decision 7): masterSecretFile when set, else <dataDir>/s3gateway/master.key. With neither, the master is generated in memory and never written (the InMemory preset, tests). cmd/funcd sets it from s3gateway.masterSecretFile and storage.dataDir.

func WithMasterSecret added in v0.11.0 

func WithMasterSecret(secret []byte) Option

WithMasterSecret hands the platform a node master secret the embedder already loaded (cmd/funcd loads it once at start for ADR-0204's backup envelope too); it replaces WithMasterLocation's load and migration. Empty ⇒ fault.Invalid.

func WithMaterializer 

func WithMaterializer(m function.Materializer) Option

WithMaterializer overrides the artifact Materializer (ADR-0030). When a shim is configured but no Materializer is supplied, the local-file driver is used (the OCI driver is P-V-A). Has no effect unless a runtime shim is also configured.

func WithNestedInFlightCap added in v0.4.0 

func WithNestedInFlightCap(n int) Option

WithNestedInFlightCap sets the per-target cap on nested fn-to-fn calls in flight (ADR-0147, invoke.maxNestedInFlight): the next call to a Function with n calls in flight is refused with 429. 0 ⇒ the default (10); a negative value is fault.Invalid from New. The cap cannot be disabled.

func WithNodePlatform added in v0.2.0 

func WithNodePlatform(p v1.OCIPlatform) Option

WithNodePlatform sets the platform this node runs (ADR-0145): the scheduler refuses an artifact built for other platforms, and the materializer pulls an image index's manifest for this one. Default: the daemon's own GOOS/GOARCH (v1.HostPlatform), which is right whenever funcd runs on the node it schedules.

func WithNormalizedLogFields added in v0.8.0 

func WithNormalizedLogFields() Option

WithNormalizedLogFields makes funcd's own lines through a WithLogger logger write a duration as a <key>_ms number of milliseconds and the time in UTC, truncated to the millisecond (the handler decides how many fractional digits it prints). Off by default. Without WithLogger it changes nothing (ADR-0197).

func WithPacing added in v0.6.0 

func WithPacing(p Pacing) Option

WithPacing sets the pacing times (ADR-0163). A negative field, the five orderings of Decision 5, a non-zero AppUpgradeTimeout at or below BootTimeout (ADR-0200), a non-zero LivenessTimeout below twice SupervisionPeriod or a StorageProbeTimeout not below StorageProbeInterval (ADR-0215), broken on the effective values (a zero field read as its default; a zero DeliveryBackoffMax is max(10s, DeliveryBackoffInitial)), ⇒ fault.Invalid naming the field.

func WithPlatformBackup added in v0.11.0 

func WithPlatformBackup(r *runner.Runner) Option

WithPlatformBackup runs the platform backup (ADR-0205): New binds r to the event store, the metastore and the run state, Run runs it, and the control plane's platformbackup route reads its status. nil ⇒ no backup stream; the route reads enabled: false.

func WithPoolLimit 

func WithPoolLimit(limit int) Option

WithPoolLimit caps handlers per pool worker (ADR-0046 Decision 3): over-cap members declaring one worker id are held NotReady with a PoolFull condition. 0 ⇒ the default (16).

func WithPoolManifestDir added in v0.5.0 

func WithPoolManifestDir(dir string) Option

WithPoolManifestDir sets the dir pool manifests are written to: a 0700 dir funcd owns, created when absent and emptied at start, since the manifests carry each member's credentials. Unset ⇒ a private temp dir removed at Shutdown.

func WithPoolShim 

func WithPoolShim(cmd ...string) Option

WithPoolShim enables worker pooling (ADR-0046): cmd is the launch prefix for the node-family default pooled worker_threads host (e.g. "node", "/opt/funcd/pool.mjs"), which hosts only a runtime that starts with "node" (ADR-0149); another family pools only on its own WithPoolShimFor host. A function declaring spec.pooling.worker then co-locates with same-(namespace, runtime, worker-id) peers in one pool worker, launched with this command + the FUNCD_POOL_MANIFEST of its admitted members. With no pool shim configured pooling is off and every function runs solo (the default). New refuses it together with WithContainerExecution, where every function runs solo (ADR-0173).

func WithPoolShimFor 

func WithPoolShimFor(runtimeFamily string, cmd ...string) Option

WithPoolShimFor registers a pooled-host launch prefix for one runtime family (ADR-0050): a python* function that opts into spec.pooling.worker co-pools via this host (the subinterpreter pool.py) instead of staying solo. WithPoolShim remains the node default. A runtime family with no pool host runs solo — so this is additive and host-gated. Used as WithPoolShimFor("python", "python3.14", "/opt/funcd/pool.py"). New refuses it together with WithContainerExecution, where every function runs solo (ADR-0173).

func WithProviderStorage added in v0.13.0 

func WithProviderStorage(root string) Option

WithProviderStorage sets the add-on engines' storage root (ADR-0231); "" keeps durable storage off.

func WithRuntime 

func WithRuntime(r runtime.Runtime) Option

WithRuntime injects the function runtime (worker) port.

func WithRuntimeShim 

func WithRuntimeShim(cmd ...string) Option

WithRuntimeShim enables real function execution (ADR-0030): cmd is the launch prefix for the node-family default shim (e.g. "node", "/opt/funcd/shim.mjs"), to which the reconciler appends the artifact + handler via the environment. It runs only a runtime that starts with "node"; any other runtime needs its own WithRuntimeShimFor, else it is Failed with RuntimeUnavailable (ADR-0149). With no shim configured the reconciler runs the legacy placeholder (no execution).

func WithRuntimeShimFor 

func WithRuntimeShimFor(runtimeFamily string, cmd ...string) Option

WithRuntimeShimFor registers a shim launch prefix for one runtime family (ADR-0049): a function whose spec.runtime starts with runtimeFamily (e.g. "python") is launched with cmd instead of the default WithRuntimeShim. Lets one daemon run several curated languages — e.g. node by default plus WithRuntimeShimFor("python", "python3", "/opt/funcd/shim.py"). The rest of execution (artifact + handler env, portfile handshake, readiness) is identical per language.

func WithS3Gateway 

func WithS3Gateway(listenAddr, endpoint string, maxUploadBytes int64, masterSecretFile, dataDir string) Option

WithS3Gateway enables the opt-in S3-protocol frontend over the blob substrate (ADR-0080/0085): a node-private TCP listener serving GET(+range)/PUT(+multipart)/ HEAD/DELETE/ListObjectsV2 governed by the cedar spec.blob binding-as-grant PEP, with per-function SigV4 keypairs derived from a node master secret and injected into a spec.blob function's worker env. listenAddr is node-private (e.g. 127.0.0.1:9000); maxUploadBytes (0 ⇒ 1 GiB) caps a single buffered object; masterSecretFile and dataDir locate the node master as WithMasterLocation does. Without this option no listener, IAM, or keypair injection exists.

func WithSQLCallTimeout added in v0.13.0 

func WithSQLCallTimeout(d time.Duration) Option

WithSQLCallTimeout bounds one context.sql call (ADR-0233, sql.callTimeout); 0 ⇒ 30 s.

func WithSQLChangeFeedPort added in v0.13.0 

func WithSQLChangeFeedPort(port int) Option

WithSQLChangeFeedPort sets the port the engines post their changes to (ADR-0235, sql.changeFeedPort); 0 ⇒ 7075.

func WithSQLDatabaseQuota added in v0.13.0 

func WithSQLDatabaseQuota(maxPerNamespace int) Option

WithSQLDatabaseQuota sets the per-namespace SQLDatabase count cap enforced at admission (ADR-0232, sql.maxDatabasesPerNamespace). 0 ⇒ the default (20); a negative value disables the quota.

func WithSQLProviderRuntime added in v0.13.0 

func WithSQLProviderRuntime(r provider.Runtime) Option

WithSQLProviderRuntime overrides the SQLDatabase engine runtime (ADR-0232); the production runtime supervises the rqlite container, tests and `funcdctl dev` (ADR-0237) inject their own. It must implement provider.Volumes.

func WithSensorDelivery added in v0.4.0 

func WithSensorDelivery(maxInFlight, maxInFlightPerTarget, maxQueuedPerSensor int) Option

WithSensorDelivery sizes the Sensor delivery queue every attempt runs on (ADR-0156): maxInFlight delivery workers, at most maxInFlightPerTarget attempts in flight to one Function or Workflow, and at most maxQueuedPerSensor undelivered deliveries per Sensor (one more is dead-lettered at once). Each must be at least 1 and the per-target cap at most maxInFlight, else Invalid. Without this option: 32, 4, 4096.

func WithSiteDefaultIndex 

func WithSiteDefaultIndex(index string) Option

WithSiteDefaultIndex sets the document a Site serves for "/" (and asserts present before Ready) when its spec.index is empty (ADR-0139, F103). "" ⇒ "index.html". A relative path, never a leading '/'.

func WithStore 

func WithStore(s store.Store) Option

WithStore injects the metastore (database layer) port.

func WithTLS 

func WithTLS(spec edgetls.Spec) Option

WithTLS enables TLS termination (ADR-0111, F74) on BOTH listeners (control-plane + data-plane) via ServeTLS — funcd keeps its own http.Servers (no handover). The zero Mode defaults to `selfsigned` (stdlib, offline, generated+persisted). Omit it entirely for plaintext (the back-compat default). selfsigned and acme persist key material under spec.StorageDir, which defaults to <artifact store>/funcd-tls; with neither set, Run fails with fault.Invalid.

func WithTelemetry 

func WithTelemetry(t *observability.Telemetry) Option

WithTelemetry injects the OTel telemetry pipeline. If not set, the no-op pipeline is used (no collector required).

func WithWorkflow 

func WithWorkflow(dataDir string, defaultStepTimeout, retention time.Duration, defaultRetry int, payloadLimit int64) Option

WithWorkflow tunes the workflow engine (ADR-0094). The engine is always wired; without this option it runs in memory with the daemon config's defaults (300s step timeout, 720h retention, one attempt, 256 KiB payload cap). This option sets its persistence + tunables: dataDir is the Badger run-state directory (empty ⇒ in-memory), defaultStepTimeout bounds a single step invocation (0 ⇒ none), retention is how long terminal runs survive before the periodic sweep reclaims them (0 ⇒ never), defaultRetry is the per-step attempt cap when a step declares no retry (< 1 ⇒ 1), and payloadLimit caps a run's input (at admission) and a step's output in bytes (0 ⇒ unbounded). cmd/funcd derives dataDir as <dataDir>/workflow from config.

func WithWorkflowContractResolver 

func WithWorkflowContractResolver(r workflow.ContractResolver) Option

WithWorkflowContractResolver overrides the workflow F65 typed-edge ContractResolver (ADR-0098). The production resolver reads a step image's I/O contract from OCI metadata; `funcdctl dev` (ADR-0125) injects a resolver for from-source steps, whose file:// bundles carry no OCI artifact to inspect.

func WithWorkflowMaxStepsInFlight added in v0.4.0 

func WithWorkflowMaxStepsInFlight(n int) Option

WithWorkflowMaxStepsInFlight sets workflow.maxStepsInFlight (ADR-0146); default 64, 0 means no cap.

func WithoutFunclog 

func WithoutFunclog() Option

WithoutFunclog disables function-log capture: no structured records (Path B) and no stored raw stdout/stderr (Path A); the runtime keeps only each worker's tail (ADR-0168).

func WithoutFunclogTraces 

func WithoutFunclogTraces() Option

WithoutFunclogTraces disables the traces signal (ADR-0101, per-invocation spans) while keeping the logs signal. Subordinate to WithoutFunclog: with the whole funclog channel off, there is no channel and this is moot. With the channel on but traces off, the host's trace sink is nil and span lines are read off the channel and dropped. Traces are on by default when the runtime supports capture.

func WithoutLogCompaction 

func WithoutLogCompaction() Option

WithoutLogCompaction disables compacted compaction: no compactor goroutine runs and raw OTLP-JSONL is left untouched (capture itself still runs).

type Pacing added in v0.6.0 

type Pacing struct {
	RetryBackoffMax, ReferentPollInterval, RouteResyncInterval, SupervisionPeriod, BootTimeout  time.Duration
	DrainGrace, HandOutSettle, DrainPollInterval, EnginePollInterval, EngineProbeTimeout        time.Duration
	ArtifactPollInterval, DefaultRetryBackoff, BucketRecheckInterval, DeliveryBackoffInitial    time.Duration
	DeliveryBackoffMax, ActivationTimeout, ReclaimInterval, ShutdownTimeout, WorkerSyncInterval time.Duration
	// AppUpgradeTimeout bounds an App upgrade (ADR-0200): zero ⇒ max(5m, twice the effective BootTimeout).
	AppUpgradeTimeout time.Duration
	// LivenessTimeout is how long a listening replica may stay silent on /health/liveness (ADR-0215): zero ⇒
	// DefaultLivenessTimeout of the effective SupervisionPeriod; a set one is at least twice it. StorageProbeInterval
	// and StorageProbeTimeout pace the storage probes: zero ⇒ 10s and 2s; the effective timeout is less than the
	// effective interval.
	LivenessTimeout, StorageProbeInterval, StorageProbeTimeout time.Duration
}

Pacing holds the retry, requeue, supervision, wake, drain and probe times of the daemon config (ADR-0163). A zero field keeps today's value.

type Platform 

type Platform struct {
	// contains filtered or unexported fields
}

Platform is the assembled funcd runtime — the composition root built by New.

func New 

func New(opts ...Option) (_ *Platform, err error)

New assembles the platform from opts, validates every required dependency, builds the control plane (controller + reconcilers + API server), and binds the control-plane listener (so Addr() is ready before Run). It returns a typed fault (and a nil *Platform) on a missing dep or a build/bind failure — never a partial platform, never a panic.

func (*Platform) Addr 

func (p *Platform) Addr() string

Addr returns the bound control-plane address (host:port), available after New.

func (*Platform) DataPlaneAddr 

func (p *Platform) DataPlaneAddr() string

DataPlaneAddr returns the bound data-plane (function-invocation) address, available after New (ADR-0033).

func (*Platform) EgressWorkerIndex 

func (p *Platform) EgressWorkerIndex() *egress.MemoryWorkerIndex

EgressWorkerIndex returns the egress WorkerIndex the containerd runtime populates at worker provisioning (ADR-0117 §5): on worker-up it records the funcd0 IP → the worker's principal Ref (its owner kind) so the gateway can authenticate the caller by source IP. nil ⇒ egress is not enabled.

func (*Platform) Providers 

func (p *Platform) Providers() *provider.Catalog

Providers returns the platform's provider catalog (ADR-0082), available after New.

func (*Platform) Run 

func (p *Platform) Run(ctx context.Context) error

Run starts the control loops + the control-plane server and blocks until ctx is cancelled, then shuts down gracefully and returns nil. It owns the crash-only lifecycle (ADR-0028): a setup error, such as an S3 gateway that cannot bind its address, also shuts the platform down before Run returns it.

func (*Platform) Shutdown 

func (p *Platform) Shutdown(ctx context.Context) error

Shutdown closes the platform's components (the control-plane listener, the five ports, telemetry). It is concurrency-safe and idempotent (sync.Once so Run's shutdown-on-ctx and a caller's explicit Shutdown cannot race or double-close) and best-effort (joins errors, closing all even if one fails).

func (*Platform) WaitS3Gateway added in v0.2.3 

func (p *Platform) WaitS3Gateway(ctx context.Context) error

WaitS3Gateway blocks until the WithS3Gateway frontend is bound and serving (nil), it stopped first (its error), or ctx is done. The gateway binds its address only once Run starts it (ADR-0085), so a taken port surfaces here and from Run, not from New. Without the gateway it returns nil.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.