Documentation
¶
Overview ¶
Package backup runs an app owner's backups (ADR-0222, F111): the BackupSchedule reconciler takes each cron slot and keeps the schedule's status and RPO alert, the Backup reconciler runs one copy with the platform's rights and deletes the record at its expireTime, and the Restore reconciler loads a Backup's members into empty stores or in place. RBAC at admission is the whole boundary (Decision 10).
Index ¶
Constants ¶
const ( ReasonMemberNotFound = "MemberNotFound" ReasonScheduleNotFound = "ScheduleNotFound" ReasonTargetUnconditional = "TargetUnconditional" ReasonLakeUnstable = "LakeUnstable" ReasonInterrupted = "Interrupted" ReasonNotEmpty = "NotEmpty" ReasonIntegrity = "Integrity" ReasonExportFailed = "ExportFailed" ReasonSameProvider = "SameProvider" // ReasonEngineNotReady is a run that needs a database whose engine is not Ready (ADR-0234). ReasonEngineNotReady = "EngineNotReady" // ReasonNamespaceHeld is an in-place Restore whose namespace already carries a restore marker. ReasonNamespaceHeld = "NamespaceHeld" )
The reasons a record's Ready condition names (Decisions 3 to 7).
Variables ¶
This section is empty.
Functions ¶
func RPORisk ¶
func RPORisk(t *cron.Timetable, paused bool, since, now time.Time, phase func(slot time.Time) (v1.RunPhase, bool)) bool
RPORisk is Decision 9's rule: not paused, and the slot after since (the newest Succeeded Backup's start, else the schedule's creation) has passed with its Backup Failed or absent, or a second slot has passed. phase reads a slot's Backup.
Types ¶
type BackupReconciler ¶
type BackupReconciler struct {
// contains filtered or unexported fields
}
BackupReconciler is the controller.Reconciler for KindBackup (Decision 4).
func (*BackupReconciler) Reconcile ¶
func (r *BackupReconciler) Reconcile(ctx context.Context, req controller.Request) (controller.Result, error)
Reconcile drives a Backup Pending → Running → Succeeded | Failed, one attempt. A new Backup gets its expireTime (creation + its ttl or its schedule's); a Pending one waits while the platform is held, but for a Restore's export; a Running one this process does not run was interrupted (Interrupted), unless its copy is whole on the target (ADR-0287 Decision 5); a finished one is deleted at its expireTime. The run itself, with the platform's rights, is a goroutine whose end writes the record.
type Deps ¶
type Deps struct {
Store store.Store
Secrets SecretReader
// Kinds are the member kinds a Backup copies and a Restore loads, each served once (ADR-0311).
Kinds []workload.MemberKind
// Hold nil is a platform never held, whose in-place Restore holds nothing.
Hold Hold
// StoreURL is the blob store's URL, blob.target or the file:// URL of blob.dir: a schedule on its provider is
// Ready with reason SameProvider (Decision 6). "" compares with nothing.
StoreURL string
// Period re-checks a schedule at the latest after it, the namespace hold's release enqueuing nothing, and paces a
// Backup waiting on the platform hold; 0 ⇒ controller.SupervisionPeriod.
Period time.Duration
Clock clock.Clock
Meter metric.Meter
Logger *slog.Logger
}
Deps are the reconcilers' dependencies; Store and Secrets are required.
type Hold ¶
type Hold interface {
hold.Gate
hold.NamespaceGate
HoldNamespace(ns v1.NamespaceName, m hold.Marker) error
ReleaseNamespaceMarker(ns v1.NamespaceName, m hold.Marker) error
}
Hold is the daemon's hold (ADR-0206): the platform gate the runs wait on, the namespace gate the slots ask, and the namespace hold an in-place Restore takes.
type Reconcilers ¶
type Reconcilers struct {
Schedules *ScheduleReconciler
Backups *BackupReconciler
Restores *RestoreReconciler
}
Reconcilers are the three kinds' reconcilers, sharing one base.
func New ¶
func New(d Deps) (*Reconcilers, error)
New builds the reconcilers and registers the metrics: funcd.backup.runs and .duration_ms with stream=workload, and the gauge funcd.backup.workload_rpo_risk, the schedules at risk. A nil kind, or a kind two of Kinds serve, is fault.Invalid naming it.
func (*Reconcilers) Wait ¶
func (r *Reconcilers) Wait()
Wait blocks until every run this process started has ended; funcd's shutdown calls it after the controller stops.
type RestoreReconciler ¶
type RestoreReconciler struct {
// contains filtered or unexported fields
}
RestoreReconciler is the controller.Reconciler for KindRestore (Decision 7).
func (*RestoreReconciler) MapBackup ¶
func (r *RestoreReconciler) MapBackup(ctx context.Context, obj v1.Object) []controller.Request
MapBackup maps a Backup to the Restores that read it or wait for it as their export.
func (*RestoreReconciler) Reconcile ¶
func (r *RestoreReconciler) Reconcile(ctx context.Context, req controller.Request) (controller.Result, error)
Reconcile drives a Restore Pending → Running → Succeeded | Failed. It waits for its Backup to succeed; an in-place Restore first runs Backup <restore>-before of the Backup's schedule and waits for it (gone ⇒ ScheduleNotFound, failed ⇒ ExportFailed, nothing written). The load is a goroutine; a Running Restore this process does not run was interrupted. Restores run while the platform is held.
type ScheduleReconciler ¶
type ScheduleReconciler struct {
// contains filtered or unexported fields
}
ScheduleReconciler is the controller.Reconciler for KindBackupSchedule (Decisions 3, 9).
func (*ScheduleReconciler) MapBackup ¶
func (r *ScheduleReconciler) MapBackup(_ context.Context, obj v1.Object) []controller.Request
MapBackup maps a Backup to its schedule, whose status follows its Backups.
func (*ScheduleReconciler) Reconcile ¶
func (r *ScheduleReconciler) Reconcile(ctx context.Context, req controller.Request) (controller.Result, error)
Reconcile takes the newest due slot S of a schedule (Decision 3) and writes its status (Decision 9). S is skipped, lastScheduleTime kept, while the schedule is paused or its namespace held, so the missed slots collapse into one catch-up; while one of its Backups is Pending or Running, S creates none and is taken, so no run overlaps another. Else S creates Backup <schedule>-<S in Unix minutes>, a Conflict counting as done, and lastScheduleTime becomes S. A deleted schedule leaves its Backups (they outlive it). After a platform restore, until a sync of its target has recorded the copies made after the restored point, the schedule takes no slot (ADR-0287 Decision 2).
Source Files