config

package
v0.43.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 13, 2026 License: Apache-2.0 Imports: 20 Imported by: 0

Documentation

Overview

Package config is the funcd daemon config — funcdconfig.yaml (ADR-0061, ADR-0062). It is ONE struct populated from file + env + default and validated once: 

defaults() → yaml.UnmarshalStrict (file) → env.Parse (FUNCD_* overlay) → --memory flag → Validate

precedence flag > env > file > default. A key is defined in one place — a single Config field with three tags: `json` is the yaml key (sigs.k8s.io/yaml maps yaml→json→struct, reusing json tags as in ADR-0061), `env` is the FUNCD_* overlay var (caarlos0/env, which leaves a field untouched when its var is unset — no clobber), `validate` is the rule (go-playground/validator, the lib huma already pulls). Validation runs on the MERGED struct, so a bad value from any source is caught. It is a leaf (no driver imports); cmd/funcd maps Config → []funcd.Option.

Index

Constants

View Source 
const (
	APIVersion = "funcd.io/v1alpha1"
	Kind       = "FuncdConfig"
)

APIVersion / Kind are the optional funcdconfig.yaml envelope (validated only when present).

View Source 
const (
	DefaultFunctionCPU    = "1"
	DefaultFunctionMemory = "512Mi"
)

The default of functions.defaultResources (ADR-0291 Decision 3).

View Source 
const (
	DefaultKVSweepInterval = time.Second
	MinKVSweepInterval     = 100 * time.Millisecond
)

The default and the floor of kvstore.sweepInterval (ADR-0320).

View Source 
const (
	MinLakeSaveInterval = 500 * time.Millisecond
	MaxLakeSaveInterval = time.Hour
)

The bounds of lake.saveInterval, both included (ADR-0274 Decision 1).

View Source 
const (
	DefaultQuarantineRetention = 168 * time.Hour
	MinQuarantineRetention     = time.Hour
)

The default and the floor of storage.quarantineRetention (ADR-0288 Decision 4).

View Source 
const (
	DefaultWorkloadBackupMaxListedKeys    = 1 << 20
	DefaultWorkloadBackupMaxListedKeySize = "256MiB"
	DefaultWorkloadBackupMaxCopyMembers   = 1024
)

The workloadBackup keys' defaults.

View Source 
const DefaultImagePrefix = "funcd/runtime-"

DefaultImagePrefix is the built-in runtime.containerd.imagePrefix, the repository the embedded curated runtime images are tagged under. With it only the embedded images are used: a runtime image is pulled only from a registry the operator chose, an imageOverride entry or a custom imagePrefix.

View Source 
const DefaultLakeCatalogMaxSize = "256MiB"

DefaultLakeCatalogMaxSize caps one Lake's catalog when lake.catalogMaxSize is empty (ADR-0293 Decision 3, its default lowered by ADR-0294).

View Source 
const DefaultStorageMinFreeSize = "2GiB"

DefaultStorageMinFreeSize is the free space funcd keeps on the data filesystem when storage.minFreeSize is empty (ADR-0296 Decision 1).

View Source 
const (
	MinLakeScratchBytes = 1 << 30
)

The Lake engine's scratch (ADR-0294 Decision 6) holds the catalog twice, the copy and its checkpoint, plus at least lakeScratchMargin for ext4's own overhead and the spills; empty, it is at least MinLakeScratchBytes.

Variables

This section is empty.

Functions

func IsLoopbackAddr added in v0.38.0 

func IsLoopbackAddr(addr string) bool

IsLoopbackAddr reports whether addr, a host:port to bind, stays on this machine: its host is localhost or an IP with IsLoopback (ADR-0314 Decision 2). 0.0.0.0, ::, an empty host, any other address or hostname and an addr that does not split into host and port are not.

func Locate 

func Locate(explicit string) (string, error)

Locate returns the config file path to load: explicit (--config; must exist → else fault.NotFound) → $FUNCD_CONFIG (must exist) → first existing of ./funcdconfig.yaml, /etc/funcd/funcdconfig.yaml → "" (none; zero-config). An explicit/env path that doesn't exist is an error; the implicit search paths may be absent.

Types

type BackupTimes added in v0.10.0 

type BackupTimes struct{ Interval, RPO, RetryInterval time.Duration }

BackupTimes are backup.interval, .objectives.rpo and .retryInterval, parsed (ADR-0205 Decision 1).

type BlobTimes added in v0.10.0 

type BlobTimes struct{ Interval, Rebaseline, Retention, VersionRetention time.Duration }

BlobTimes are blob.backup.interval, .rebaseline, .retention and blob.versionRetention, parsed; VersionRetention 0 is unset (ADR-0208 Decision 1).

type Config 

type Config struct {
	APIVersion string `` /* 184-byte string literal not displayed */
	Kind       string `` /* 292-byte string literal not displayed */
	Server     struct {
		ListenAddr    string `` /* 195-byte string literal not displayed */
		DataPlaneAddr string `` /* 262-byte string literal not displayed */
		// BaseDomain is the domain under which every namespace but default answers, on <namespace>.<baseDomain>
		// (ADR-0240). funcd validates it at start.
		BaseDomain string `` /* 172-byte string literal not displayed */
		// TLS termination (ADR-0111, F74). When Enabled, both listeners serve HTTPS via ServeTLS.
		// Mode defaults to selfsigned (stdlib, offline). Empty/Enabled=false ⇒ plaintext (default).
		TLS struct {
			Enabled  bool     `json:"enabled,omitempty" env:"FUNCD_TLS_ENABLED" doc:"When true, both listeners serve HTTPS."`
			Mode     string   `` /* 273-byte string literal not displayed */
			Hosts    []string `json:"hosts,omitempty" env:"FUNCD_TLS_HOSTS" envSeparator:"," doc:"The host names that the certificate covers."`
			CertFile string   `json:"certFile,omitempty" env:"FUNCD_TLS_CERT_FILE" doc:"The certificate file, in provided mode."`
			KeyFile  string   `json:"keyFile,omitempty" env:"FUNCD_TLS_KEY_FILE" doc:"The private key file, in provided mode."`
			Email    string   `json:"email,omitempty" env:"FUNCD_TLS_EMAIL" doc:"The contact email of the ACME account, in acme mode."`
			CADir    string   `` /* 130-byte string literal not displayed */
		} `json:"tls,omitempty"`
		// Ingress protection limits (ADR-0112, F75). The rate, size and in-flight limits are off at 0; maxKeys is
		// a table size (min 1, default 4096) with no off switch (ADR-0164).
		Limits struct {
			RatePerMin   int    `` /* 174-byte string literal not displayed */
			Burst        int    `` /* 182-byte string literal not displayed */
			Key          string `` /* 214-byte string literal not displayed */
			MaxBodyBytes int64  `` /* 195-byte string literal not displayed */
			MaxInFlight  int    `` /* 178-byte string literal not displayed */
			MaxKeys      int    `` /* 153-byte string literal not displayed */
		} `json:"limits,omitempty"`
		// Edge authn PEP (ADR-0113, F77): enable per-target auth-stance enforcement on the data plane.
		Auth struct {
			Edge bool `` /* 282-byte string literal not displayed */
		} `json:"auth,omitempty"`
		// Edge observability (ADR-0114, F76): RED metrics + edge trace span + access log. Off by default.
		Observability struct {
			Metrics   bool `` /* 133-byte string literal not displayed */
			AccessLog bool `json:"accessLog,omitempty" env:"FUNCD_OBS_ACCESS_LOG" doc:"When true, the data plane logs each request."`
			Trace     bool `json:"trace,omitempty" env:"FUNCD_OBS_TRACE" doc:"When true, the data plane starts a trace span for each request."`
		} `json:"observability,omitempty"`
		// Edge shaping (ADR-0114, F78): CORS / response headers / gzip compression. Off by default.
		Shaping struct {
			CORS struct {
				AllowOrigins  []string `` /* 148-byte string literal not displayed */
				AllowMethods  []string `` /* 137-byte string literal not displayed */
				AllowHeaders  []string `` /* 146-byte string literal not displayed */
				MaxAgeSeconds int      `` /* 175-byte string literal not displayed */
			} `json:"cors,omitempty"`
			Headers struct {
				// The env form splits pairs on ",", so a header value that contains a comma needs the file.
				Set    map[string]string `` /* 317-byte string literal not displayed */
				Remove []string          `` /* 131-byte string literal not displayed */
			} `json:"headers,omitempty"`
			Compression bool `json:"compression,omitempty" env:"FUNCD_SHAPING_COMPRESSION" doc:"When true, the data plane compresses responses with gzip."`
		} `json:"shaping,omitempty"`
		// Egress network isolation (ADR-0115, FEAT-0007/F80): the worker-egress default-deny substrate.
		// Off by default (phased); Linux/containerd only (a no-op elsewhere). When enabled, funcd programs
		// an nftables policy over the funcd0 bridge that default-denies worker egress and redirects
		// remaining external TCP into the egress gateway (F81). InternalAllow are the worker-reachable
		// node-service addresses (host:port) passed directly; DNSResolver is the DNS forwarder's upstream, read
		// only with a forwarder.
		Network struct {
			Egress            bool `` /* 239-byte string literal not displayed */
			EgressGatewayPort int  `` /* 245-byte string literal not displayed */
			// DNSForwarderPort is the funcd DNS forwarder's port on the bridge address (ADR-0117, F81, ADR-0315): worker
			// :53 is REDIRECTed into it so it is the only reachable resolver (the domain trust anchor). It answers known
			// workers only, and forwards only the names an EgressPolicy domain rule allows them. Wired with the gateway
			// when Egress is on (Linux/containerd only). Zero ⇒ neither runs, and nothing goes out, DNS included.
			DNSForwarderPort int      `` /* 343-byte string literal not displayed */
			DNSResolver      string   `json:"dnsResolver,omitempty" env:"FUNCD_NETWORK_DNS_RESOLVER" doc:"The upstream resolver that the DNS forwarder asks."`
			InternalAllow    []string `` /* 162-byte string literal not displayed */
			// WorkerSyncInterval is the egress WorkerIndex sync cadence (ADR-0163), a positive duration.
			WorkerSyncInterval string `` /* 184-byte string literal not displayed */
		} `json:"network,omitempty"`
		// ShutdownTimeout bounds the HTTP, Sensor and workflow-run drain at shutdown (ADR-0163), a positive duration.
		ShutdownTimeout string `` /* 192-byte string literal not displayed */
	} `json:"server,omitempty"`
	Storage struct {
		Mode    string `` /* 441-byte string literal not displayed */
		DataDir string `` /* 469-byte string literal not displayed */
		// MetastoreDir is the control-plane metastore's dedicated Badger directory (ADR-0065). Empty ⇒
		// derived as <DataDir>/store in Load(); ignored (in-memory engine) when Mode is memory. Its own
		// instance, never shared — see the store-per-service rule (restore class + service ownership).
		MetastoreDir string `` /* 243-byte string literal not displayed */
		// QuarantineRetention is how long the start-up reclaims keep the data no object names before the sweep deletes
		// it (ADR-0288): an ADR-0194 duration of at least 1h; empty ⇒ 168h.
		QuarantineRetention string `` /* 600-byte string literal not displayed */
		// MinFreeSize is the free space funcd keeps on DataDir's filesystem for its own stores: workload writes that
		// would take it lower get 507 (ADR-0296). A ByteSize; empty ⇒ 2GiB; "0" turns the floor off.
		MinFreeSize string `` /* 386-byte string literal not displayed */
	} `json:"storage,omitempty"`
	Kvstore struct {
		// Engine for the function-facing KV service (ADR-0066/0069): memory (default, ephemeral) or
		// badger (durable). Its own dedicated instance. DataDir is empty ⇒ derived as <Storage.DataDir>/kv
		// in Load(); an explicit value overrides the default location. Ignored (in-memory) when Storage.Mode
		// is memory.
		Engine  string `` /* 306-byte string literal not displayed */
		DataDir string `` /* 273-byte string literal not displayed */
		// MaxStoresPerNamespace is the per-namespace KVStore count cap enforced at admission (ADR-0072);
		// 0 ⇒ the default (100); a negative value disables the quota.
		MaxStoresPerNamespace int `` /* 213-byte string literal not displayed */
		// SweepInterval is how often the KV service deletes the keys that expired (ADR-0320), so the change feed, the
		// backup and the quota see each expiry: an ADR-0194 duration of at least 100ms; empty ⇒ 1s.
		SweepInterval string `` /* 289-byte string literal not displayed */
		// Backup is the opt-in DR export of the KV instance (ADR-0067) on the common backup format (ADR-0209), off
		// by default. The target group (Target, CredentialsFile, SingleWriter) and the encryption group each come
		// whole from here when their lead key is set, else from backup: (ResolveKVBackup); ignored with a warning when
		// Storage.Mode is memory. Interval/Rebaseline/RebaselineRetry are durations ("30s"); RebaselineRetry is the
		// delay after a failed re-baseline (ADR-0195). Retention is the bases' ladder in hours, days and weeks.
		Backup struct {
			Enabled         bool   `` /* 415-byte string literal not displayed */
			Target          string `` /* 310-byte string literal not displayed */
			CredentialsFile string `` /* 290-byte string literal not displayed */
			SingleWriter    bool   `` /* 396-byte string literal not displayed */
			Interval        string `` /* 210-byte string literal not displayed */
			Rebaseline      string `` /* 336-byte string literal not displayed */
			RebaselineRetry string `` /* 220-byte string literal not displayed */
			ChunkBytes      int    `` /* 239-byte string literal not displayed */
			Encryption      struct {
				Recipients []string `` /* 368-byte string literal not displayed */
				None       bool     `` /* 286-byte string literal not displayed */
			} `json:"encryption,omitempty"`
			Retention struct {
				Hourly int `` /* 362-byte string literal not displayed */
				Daily  int `` /* 294-byte string literal not displayed */
				Weekly int `` /* 299-byte string literal not displayed */
			} `json:"retention,omitempty"`
		} `json:"backup,omitempty"`
		// Cdc is the opt-in change-feed of the KV instance to the bus (ADR-0068), off by default. Enabled
		// without a Sink, or with Engine memory ⇒ fault.Invalid at startup; ignored with a warning when Storage.Mode
		// is memory. Retention is a duration ("24h").
		Cdc struct {
			Enabled   bool   `` /* 445-byte string literal not displayed */
			Sink      string `` /* 159-byte string literal not displayed */
			Retention string `` /* 173-byte string literal not displayed */
		} `json:"cdc,omitempty"`
	} `json:"kvstore,omitempty"`
	// Backup is the platform backup target (ADR-0203), run by ADR-0205. Target is s3:// or file:///<absolute dir>;
	// CredentialsFile (s3:// only) is an AWS shared credentials file whose [default] profile signs every request.
	// Retention is in hours (hourly), days (daily, verified) and weeks (weekly).
	Backup struct {
		Target          string `` /* 638-byte string literal not displayed */
		CredentialsFile string `` /* 294-byte string literal not displayed */
		SingleWriter    bool   `` /* 322-byte string literal not displayed */
		Retention       struct {
			Hourly   int `` /* 250-byte string literal not displayed */
			Daily    int `` /* 291-byte string literal not displayed */
			Weekly   int `` /* 281-byte string literal not displayed */
			Verified int `` /* 288-byte string literal not displayed */
			// PreUpgrade is the complete pre-upgrade generations funcd upgrade keeps listing as kept (ADR-0207).
			PreUpgrade int `` /* 268-byte string literal not displayed */
		} `json:"retention,omitempty"`
		// Encryption seals every generation to age recipients (ADR-0204): Recipients are paths of recipients files;
		// None is the explicit choice to store the files unsealed.
		Encryption struct {
			Recipients []string `` /* 568-byte string literal not displayed */
			None       bool     `` /* 350-byte string literal not displayed */
		} `json:"encryption,omitempty"`
		// Interval, RetryInterval and Objectives.RPO time the runs and the rpoRisk alert (ADR-0205 Decision 1).
		Interval      string `` /* 344-byte string literal not displayed */
		RetryInterval string `` /* 296-byte string literal not displayed */
		Objectives    struct {
			RPO string `` /* 385-byte string literal not displayed */
		} `json:"objectives,omitempty"`
	} `json:"backup,omitempty"`
	// WorkloadBackup bounds what a BackupSchedule's target may hold (ADR-0222), with or without backup.target: the keys and
	// the bytes of keys one listing reads, the latter a ByteSize, and the members of one copy.
	WorkloadBackup struct {
		MaxListedKeys    int    `` /* 329-byte string literal not displayed */
		MaxListedKeySize string `` /* 295-byte string literal not displayed */
		MaxCopyMembers   int    `` /* 335-byte string literal not displayed */
	} `json:"workloadBackup,omitempty"`
	// Blob is the blob store (ADR-0208): Target an S3-compatible bucket funcd protects by its versioning, else the
	// local store at Dir (derived as <Storage.DataDir>/blob in Load), which Backup mirrors to backup.target while the
	// platform backup is on. VersionRetention is the store rule's noncurrent-version expiry, the window of a restore
	// to a time.
	Blob struct {
		Target           string `` /* 460-byte string literal not displayed */
		CredentialsFile  string `` /* 289-byte string literal not displayed */
		Dir              string `` /* 316-byte string literal not displayed */
		AllowUnversioned bool   `` /* 266-byte string literal not displayed */
		VersionRetention string `` /* 269-byte string literal not displayed */
		Backup           struct {
			Interval   string `` /* 406-byte string literal not displayed */
			Rebaseline string `` /* 270-byte string literal not displayed */
			Retention  string `` /* 325-byte string literal not displayed */
		} `json:"backup,omitempty"`
	} `json:"blob,omitempty"`
	// Recovery is safe mode (ADR-0207): AfterCrashes unclean starts in a row start held, twice it stop with exit
	// status 70; StableAfter is the continuous run that makes a start clean. Both are checked in cmd/funcd.
	Recovery struct {
		SafeMode struct {
			AfterCrashes int    `` /* 351-byte string literal not displayed */
			StableAfter  string `` /* 253-byte string literal not displayed */
		} `json:"safeMode,omitempty"`
	} `json:"recovery,omitempty"`
	Auth struct {
		Token      string   `` /* 417-byte string literal not displayed */
		Namespaces []string `` /* 325-byte string literal not displayed */
		// Credentials is file-only (ADR-0171 Decision 1): caarlos0/env walks a slice of structs under an
		// empty prefix, so stray 0_* variables would add zero-value entries.
		Credentials CredentialList `json:"credentials,omitempty" env:"-" validate:"dive"`
	} `json:"auth,omitempty"`
	Secrets struct {
		EncryptionKeyFile string `` /* 366-byte string literal not displayed */
	} `json:"secrets,omitempty"`
	Runtime struct {
		Mode string `` /* 393-byte string literal not displayed */
		// BootBackoffInitial and BootBackoffMax bound the wait before a worker that crashed while booting is created
		// again (ADR-0160): positive durations, the max at least the initial wait.
		BootBackoffInitial string `` /* 399-byte string literal not displayed */
		BootBackoffMax     string `` /* 344-byte string literal not displayed */
		// The supervision, boot and drain times (ADR-0163): positive durations, bootTimeout above
		// invoke.activationTimeout and handOutSettle at most drainGrace.
		SupervisionPeriod string `` /* 488-byte string literal not displayed */
		BootTimeout       string `` /* 398-byte string literal not displayed */
		DrainGrace        string `` /* 475-byte string literal not displayed */
		HandOutSettle     string `` /* 345-byte string literal not displayed */
		DrainPollInterval string `` /* 311-byte string literal not displayed */
		// LivenessTimeout is how long a listening replica may stay silent on /health/liveness before it is restarted
		// (ADR-0215): a positive duration, when set at least twice supervisionPeriod; empty ⇒ max(30s, three
		// supervisionPeriod), derived in cmd/funcd.
		LivenessTimeout string `` /* 362-byte string literal not displayed */
		// ReadinessTimeout is the window in which a worker whose readiness reads run late keeps its last answer, not the
		// bound of one probe (ADR-0259): a positive duration; empty ⇒ 5s.
		ReadinessTimeout string `` /* 371-byte string literal not displayed */
		// Process tunes the process driver (ADR-0167): StopGrace is the wait after SIGTERM before SIGKILL for a stop,
		// the shutdown close and the boot reap, a duration with 0 < d <= 10s.
		Process struct {
			StopGrace string `` /* 284-byte string literal not displayed */
		} `json:"process,omitempty"`
		// Containerd tunes the containerd driver; StopGrace is the wait after SIGTERM before SIGKILL for a single stop
		// and the daemon stop (ADR-0277), a duration with 0 < d <= 10s.
		Containerd struct {
			StopGrace   string `` /* 435-byte string literal not displayed */
			Socket      string `` /* 330-byte string literal not displayed */
			Root        string `` /* 238-byte string literal not displayed */
			Snapshotter string `` /* 158-byte string literal not displayed */
			CNIBinDir   string `` /* 220-byte string literal not displayed */
			CNIConfDir  string `` /* 287-byte string literal not displayed */
			StateDir    string `` /* 234-byte string literal not displayed */
			SubnetCIDR  string `` /* 340-byte string literal not displayed */
			// BridgeAddress is funcd's address on its container bridge (ADR-0238); empty ⇒ the subnet's network address + 1.
			BridgeAddress string            `` /* 545-byte string literal not displayed */
			ImagePrefix   string            `` /* 399-byte string literal not displayed */
			ImageOverride map[string]string `` /* 335-byte string literal not displayed */
		} `json:"containerd,omitempty"`
	} `json:"runtime,omitempty"`
	// Controller tunes the platform controllers; GCSweepInterval is the owner garbage collector's sweep period
	// (ADR-0170), a positive duration.
	Controller struct {
		GCSweepInterval string `` /* 339-byte string literal not displayed */
		// The retry and requeue times (ADR-0163): positive durations, retryBackoffMax at least 5ms.
		RetryBackoffMax      string `` /* 252-byte string literal not displayed */
		ReferentPollInterval string `` /* 443-byte string literal not displayed */
		RouteResyncInterval  string `` /* 301-byte string literal not displayed */
	} `json:"controller,omitempty"`
	Log struct {
		Format string `` /* 210-byte string literal not displayed */
		Level  string `` /* 182-byte string literal not displayed */
	} `json:"log,omitempty"`
	Telemetry struct {
		Endpoint string `` /* 201-byte string literal not displayed */
		Insecure bool   `json:"insecure,omitempty" env:"FUNCD_TELEMETRY_INSECURE" doc:"When true, funcd connects to telemetry.endpoint without TLS."`
	} `json:"telemetry,omitempty"`
	// Funclog tunes structured function-log capture (ADR-0081) and its traces signal (ADR-0101); both on by
	// default. A zero SegmentMaxBytes / empty SegmentMaxAge (a duration, "10s") keeps the sink default
	// (8 MiB / 10s). The sink writes to the blob substrate, so funcd-system is the only Bucket accepted.
	Funclog struct {
		Enabled         bool   `` /* 183-byte string literal not displayed */
		SegmentMaxBytes int    `` /* 286-byte string literal not displayed */
		SegmentMaxAge   string `` /* 317-byte string literal not displayed */
		Bucket          string `` /* 205-byte string literal not displayed */
		Traces          bool   `` /* 223-byte string literal not displayed */
		// MaxRecordBytes bounds one shim log or span record line (ADR-0168); 0 keeps the 65536 default, and funcd refuses
		// a nonzero value below 1024 or above the 1 MiB reader cap.
		MaxRecordBytes int `` /* 300-byte string literal not displayed */
	} `json:"funclog,omitempty"`
	// S3Gateway is the opt-in S3-protocol frontend over the blob substrate (ADR-0080/0085).
	// Disabled by default ⇒ no listener, no IAM, no keypair injection.
	S3Gateway struct {
		Enabled    bool   `` /* 332-byte string literal not displayed */
		ListenAddr string `` /* 255-byte string literal not displayed */
		// Endpoint is the sandbox-facing S3 URL injected into a spec.bindings.blob worker's AWS_ENDPOINT_URL_S3
		// (ADR-0085). Empty ⇒ derived: under containerd, http://<bridge address>:<port> when ListenAddr's host is
		// empty, unspecified or the bridge address (ADR-0238), else http://<ListenAddr>.
		Endpoint         string `` /* 452-byte string literal not displayed */
		MaxUploadBytes   int64  `` /* 435-byte string literal not displayed */
		MasterSecretFile string `` /* 386-byte string literal not displayed */
		// KeyRotationPeriod is how long a derived S3 key pair's window lasts (ADR-0270): a pair is valid for one to
		// two periods and never past a restart. At least 1h.
		KeyRotationPeriod string `` /* 440-byte string literal not displayed */
	} `json:"s3gateway,omitempty"`

	// Lake tunes the Lake engines (ADR-0274) and the per-Lake lake::query PEP proxies (ADR-0137), which bind the
	// bridge address (runtime.containerd.bridgeAddress, ADR-0238).
	Lake struct {
		// SaveInterval is how often a Lake engine saves its catalog after a commit, the Lake's recovery point
		// (ADR-0274): an ADR-0194 duration from 500ms to 1h, an opt-in; empty, every answer waits for a save that
		// covers it (ADR-0279). It is set by hand: funcdctl backup plan sets no Lake key (ADR-0286).
		SaveInterval string `` /* 334-byte string literal not displayed */
		// CatalogMaxSize caps one Lake's catalog in the catalog store (ADR-0293): a ByteSize, 256MiB when empty
		// (ADR-0294), at most s3gateway.maxUploadBytes. A save past it fails, and the Lake shows it (ADR-0276).
		CatalogMaxSize string `` /* 365-byte string literal not displayed */
		// ScratchSize sizes the Lake engine's scratch filesystem (ADR-0294): a ByteSize, at least twice
		// CatalogMaxSize plus 512MiB; empty, the larger of 1GiB and that sum.
		ScratchSize string `` /* 478-byte string literal not displayed */
		// EnginePollInterval and EngineProbeTimeout pace the wait for an engine's readiness probe (ADR-0163).
		EnginePollInterval string `` /* 295-byte string literal not displayed */
		EngineProbeTimeout string `` /* 242-byte string literal not displayed */
	} `json:"lake,omitempty"`

	// Workflow tunes the workflow engine (ADR-0094). Durable run state lives in its own dedicated Badger
	// instance at Workflow.DataDir (default <Storage.DataDir>/workflow; in-memory when Storage.Mode is
	// memory). DefaultStepTimeout + DefaultRetry feed the engine core. Retention is the terminal-run GC
	// horizon: a periodic sweep reclaims each closed run (engine record and WorkflowRun object) older than
	// it; 0 ⇒ no sweep. PayloadLimit caps the bytes of a run input (at WorkflowRun admission and run start)
	// and of each step output; 0 ⇒ unbounded.
	Workflow struct {
		DefaultStepTimeout string `` /* 287-byte string literal not displayed */
		DefaultRetry       int    `` /* 241-byte string literal not displayed */
		Retention          string `` /* 260-byte string literal not displayed */
		PayloadLimit       int64  `` /* 362-byte string literal not displayed */
		// MaxStepsInFlight bounds the function-step calls in flight across all runs (ADR-0146); 0 ⇒ no cap.
		MaxStepsInFlight int `` /* 228-byte string literal not displayed */
		// ArtifactPollInterval re-checks a Workflow whose step artifact is not pushed; DefaultRetryBackoff is the first
		// retry gap of a step with no retry.backoff, doubled up to 1h; 0 ⇒ none (ADR-0163).
		ArtifactPollInterval string `` /* 250-byte string literal not displayed */
		DefaultRetryBackoff  string `` /* 267-byte string literal not displayed */
		// DataDir is the run-state Badger directory. Empty ⇒ derived as <Storage.DataDir>/workflow in
		// Load(); ignored (in-memory) when Storage.Mode is memory. An explicit value overrides it.
		DataDir string `` /* 269-byte string literal not displayed */
	} `json:"workflow,omitempty"`

	// Eventing tunes the Sensor action-delivery reliability path (ADR-0118, F85). DeliveryAttempts is the
	// bounded-retry cap before a failed workflow:/function: delivery is dead-lettered. The event store (ADR-0201,
	// ADR-0300), one Badger instance holding the dead letters, the blob seen lists and the change feed's watermarks, is
	// at EventStore.DataDir (default <Storage.DataDir>/eventstore; in-memory when Storage.Mode is memory); Deadletter.Retention (TTL) and
	// Deadletter.MaxEntries (per-namespace count cap) drive the periodic retention sweep of dead letters only. MaxDeliveriesInFlight (the delivery
	// workers), MaxInFlightPerTarget and MaxQueuedPerSensor size the Sensor delivery queue (ADR-0156); each is
	// at least 1 and the per-target cap at most the workers. MaxDeliveriesInFlight is declared before
	// MaxInFlightPerTarget so a bad worker count is the error reported, not the cap's cross-field check.
	Eventing struct {
		DeliveryAttempts      int `` /* 250-byte string literal not displayed */
		MaxDeliveriesInFlight int `` /* 182-byte string literal not displayed */
		MaxInFlightPerTarget  int `` /* 291-byte string literal not displayed */
		MaxQueuedPerSensor    int `` /* 262-byte string literal not displayed */
		Deadletter            struct {
			Retention  string `` /* 248-byte string literal not displayed */
			MaxEntries int    `` /* 255-byte string literal not displayed */
		} `json:"deadletter,omitempty"`
		EventStore struct {
			// DataDir is the event store's Badger directory (ADR-0300). Empty ⇒ derived as <Storage.DataDir>/eventstore
			// in Load(); ignored (in-memory) when Storage.Mode is memory. An explicit value overrides it.
			DataDir string `` /* 379-byte string literal not displayed */
		} `json:"eventstore,omitempty"`
		// BlobPollInterval is the cadence a `blob:` EventSource's prefixes are List-polled for new objects
		// (ADR-0119, F83). A duration ("15s"); one cadence for all blob sources in V1.
		BlobPollInterval string `` /* 224-byte string literal not displayed */
		// BucketRecheckInterval re-checks every blob EventSource's Bucket; DeliveryBackoffInitial/Max pace the Sensor
		// delivery retry, an empty max following max(10s, initial) (ADR-0163).
		BucketRecheckInterval  string `` /* 296-byte string literal not displayed */
		DeliveryBackoffInitial string `` /* 258-byte string literal not displayed */
		DeliveryBackoffMax     string `` /* 276-byte string literal not displayed */
	} `json:"eventing,omitempty"`

	// Invoke tunes function invocation. MaxNestedInFlight caps the nested (fn-to-fn) calls in flight to one
	// Function (ADR-0147); 0 ⇒ the default (10). It cannot be disabled. DefaultTimeout bounds external invokes
	// only (ADR-0151): how long one waits for its response to start when the Function sets no spec.timeout; a
	// link keeps links[].timeout (30 s default). A duration (ADR-0194); empty or 0s ⇒ 60s, at most 1h.
	Invoke struct {
		MaxNestedInFlight int    `` /* 266-byte string literal not displayed */
		DefaultTimeout    string `` /* 360-byte string literal not displayed */
		// ActivationTimeout is the longest cold-start hold of a wake; ReclaimInterval the idle-reclaim cadence (ADR-0163).
		ActivationTimeout string `` /* 317-byte string literal not displayed */
		ReclaimInterval   string `` /* 304-byte string literal not displayed */
	} `json:"invoke,omitempty"`

	// Functions tunes Functions (ADR-0291). DefaultResources fills each field a solo Function's spec.resources leaves
	// empty: 1 CPU and 512Mi by default; an empty value sets no default for its field.
	Functions struct {
		DefaultResources struct {
			CPU    string `` /* 315-byte string literal not displayed */
			Memory string `` /* 311-byte string literal not displayed */
		} `json:"defaultResources,omitempty"`
	} `json:"functions,omitempty"`

	// Site tunes the declarative static web app reconciler (ADR-0139, FEAT-0003/F103). DefaultIndex is
	// the document a Site serves for "/" — and asserts present before it reports Ready — when its
	// spec.index is empty. A relative path (no leading '/').
	Site struct {
		DefaultIndex string `` /* 281-byte string literal not displayed */
	} `json:"site,omitempty"`

	// SQL tunes the SQL databases (ADR-0232, ADR-0233, ADR-0235). MaxDatabasesPerNamespace is the per-namespace SQLDatabase
	// count cap enforced at admission; 0 ⇒ the default (20); a negative value disables the quota. CallTimeout bounds
	// one context.sql call, a positive duration; empty ⇒ 30s.
	SQL struct {
		MaxDatabasesPerNamespace int    `` /* 216-byte string literal not displayed */
		CallTimeout              string `` /* 240-byte string literal not displayed */
		// ChangeFeedPort is the port the engines post their changes to (ADR-0235), on the bridge address (ADR-0238);
		// 0 ⇒ 7075 with a bridge address, else a free loopback port chosen at start (ADR-0260).
		ChangeFeedPort int `` /* 390-byte string literal not displayed */
	} `json:"sql,omitempty"`

	// Volumes turns the Functions' volumes on (ADR-0262 Decision 3): CapacityBytes is the size of the one volume image
	// on the containerd runtime, preallocated at <storage.dataDir>/volumes.img; 0 ⇒ volumes off. Capacity is the same
	// size with a binary unit, "64Gi" (ADR-0266); at most one of the two is set.
	Volumes struct {
		CapacityBytes int64  `` /* 629-byte string literal not displayed */
		Capacity      string `` /* 245-byte string literal not displayed */
	} `json:"volumes,omitempty"`

	// App tunes the App reconciler (ADR-0200). UpgradeTimeout bounds an upgrade, a duration more than
	// runtime.bootTimeout; empty ⇒ max(5m, twice runtime.bootTimeout), derived in cmd/funcd. RevisionHistory is the
	// number of AppRevisions an App keeps besides its current one.
	App struct {
		UpgradeTimeout  string `` /* 443-byte string literal not displayed */
		RevisionHistory int    `` /* 186-byte string literal not displayed */
	} `json:"app,omitempty"`

	// Health paces the storage probes behind the KVStore and Bucket status and the dependency check (ADR-0215):
	// positive durations, the timeout less than the interval.
	Health struct {
		StorageProbeInterval string `` /* 419-byte string literal not displayed */
		StorageProbeTimeout  string `` /* 265-byte string literal not displayed */
	} `json:"health,omitempty"`
}

Config is the funcd daemon config — the single source of truth (ADR-0062). Each field's tags declare its yaml key (`json`), its FUNCD_* overlay var (`env`), and its validation rule (`validate`).

func Defaults added in v0.38.0 

func Defaults() Config

Defaults is every key's built-in default, before a file or a variable applies.

func Load 

func Load(path string, flags Flags) (Config, error)

Load builds the effective Config (ADR-0062) from the file at path ("" ⇒ none): os.ReadFile, then Parse. Any read/parse/unknown-key/enum error ⇒ fault.Invalid. The returned Config is fully populated + valid.

func Parse added in v0.11.0 

func Parse(name string, data []byte, flags Flags) (Config, error)

Parse builds the effective Config from data (nil ⇒ none; name appears only in messages): defaults() → strict-decode data → overlay env (caarlos0/env; an unset FUNCD_* var leaves the field untouched) → apply the --memory flag → make storage.dataDir absolute → derive the dataDir-relative defaults → Validate.

func (Config) BackupTimes added in v0.10.0 

func (c Config) BackupTimes() (BackupTimes, error)

BackupTimes parses the run times with ADR-0194's grammar within [1ms, MaxDuration]: an empty key is its default, a malformed or out-of-bounds one fault.Invalid naming it.

func (Config) BlobTimes added in v0.10.0 

func (c Config) BlobTimes() (BlobTimes, error)

BlobTimes parses the blob times with ADR-0194's grammar within [1ms, MaxDuration]: an empty key is its default, a malformed or out-of-bounds one fault.Invalid naming it.

func (Config) BridgeAddress added in v0.13.0 

func (c Config) BridgeAddress() (netip.Addr, error)

BridgeAddress is funcd's address on its container bridge (ADR-0238), where the lake proxies, the SQL change feed and a derived S3 endpoint are reached from a container: under containerd runtime.containerd.bridgeAddress or the subnet's network address + 1, else 127.0.0.1. Validate refuses a value CheckBridge refuses, so the error is only for a Config built by hand.

func (Config) CheckBackup added in v0.10.0 

func (c Config) CheckBackup() []Finding

CheckBackup applies ADR-0205 Decision 3's rows that read only the config, errors first; the daemon's Validate and F112 run it. The run times are checked always, every other row once backup.target is set; without a target, a backup key off its default is reported as ignored, backup.encryption.* not while the KV export takes it. The kvstore.backup.* rows are ADR-0209's (checkKVBackup); blob.* is checked elsewhere.

func (Config) CheckBlob added in v0.10.0 

func (c Config) CheckBlob() []Finding

CheckBlob applies ADR-0208 Decision 1's rows, errors first, reading only the config: blob.target is s3:// and takes no blob.dir, blob.credentialsFile needs it, blob.dir lies below storage.dataDir, the times parse and a generation outlives the interval. Under storage.mode memory every blob key is ignored with one warning.

func (Config) CheckBridge added in v0.13.0 

func (c Config) CheckBridge() []Finding

CheckBridge applies ADR-0238 Decision 1: under containerd, runtime.containerd.bridgeAddress is an IP in the subnet.

func (Config) CheckFunctions added in v0.33.0 

func (c Config) CheckFunctions() []Finding

CheckFunctions refuses a functions.defaultResources that FunctionDefaultResources refuses.

func (Config) CheckKVSweep added in v0.41.0 

func (c Config) CheckKVSweep() []Finding

CheckKVSweep refuses a kvstore.sweepInterval that KVSweepInterval refuses.

func (Config) CheckLake added in v0.27.0 

func (c Config) CheckLake() []Finding

CheckLake refuses a lake.saveInterval that LakeSaveInterval refuses, a lake.catalogMaxSize that LakeCatalogMaxBytes refuses and a lake.scratchSize that LakeScratchBytes refuses.

func (Config) CheckQuarantine added in v0.30.0 

func (c Config) CheckQuarantine() []Finding

CheckQuarantine refuses a storage.quarantineRetention that QuarantineRetention refuses.

func (Config) CheckStorage added in v0.34.0 

func (c Config) CheckStorage() []Finding

CheckStorage refuses a storage.minFreeSize that StorageMinFreeBytes refuses, so a bad value fails the config's load instead of a start that safe mode counts.

func (Config) CheckWorkloadBackup added in v0.38.0 

func (c Config) CheckWorkloadBackup() []Finding

CheckWorkloadBackup refuses a workloadBackup.maxListedKeySize that WorkloadBackupMaxListedKeyBytes refuses.

func (Config) FunctionDefaultResources added in v0.33.0 

func (c Config) FunctionDefaultResources() (v1.ResourceSpec, error)

FunctionDefaultResources is functions.defaultResources, 1 CPU and 512Mi unless set, an empty field setting no default; fault.Invalid naming the key for a value ResourceSpec.Validate refuses.

func (Config) KVEncryptionKeyPrefix added in v0.10.0 

func (c Config) KVEncryptionKeyPrefix() string

KVEncryptionKeyPrefix is the block the KV's encryption group comes from, which names its keys in errors: "kvstore.backup." when encryption.recipients or encryption.none is set there, else "backup.".

func (Config) KVSweepInterval added in v0.41.0 

func (c Config) KVSweepInterval() (time.Duration, error)

KVSweepInterval is kvstore.sweepInterval parsed, how often the KV service deletes the keys that expired (ADR-0320): DefaultKVSweepInterval when empty; fault.Invalid naming the key for a value that is no ADR-0194 duration or lies below MinKVSweepInterval.

func (Config) LakeCatalogMaxBytes added in v0.33.0 

func (c Config) LakeCatalogMaxBytes() (int64, error)

LakeCatalogMaxBytes is lake.catalogMaxSize in bytes; empty, DefaultLakeCatalogMaxSize or s3gateway.maxUploadBytes when that is smaller. fault.Invalid names the key for a size that does not parse, is zero, or passes s3gateway.maxUploadBytes, which the gateway would refuse first with no word of the setting.

func (Config) LakeSaveInterval added in v0.27.0 

func (c Config) LakeSaveInterval() (time.Duration, error)

LakeSaveInterval is lake.saveInterval parsed: 0 when empty, where every Lake saves its catalog before it answers (ADR-0279); fault.Invalid naming the key for a value that is no ADR-0194 duration or lies outside [MinLakeSaveInterval, MaxLakeSaveInterval].

func (Config) LakeScratchBytes added in v0.34.0 

func (c Config) LakeScratchBytes() (int64, error)

LakeScratchBytes is lake.scratchSize in bytes: empty, the larger of MinLakeScratchBytes and twice the catalog cap plus lakeScratchMargin; fault.Invalid names the key for a size that does not parse or is below that sum.

func (Config) QuarantineRetention added in v0.30.0 

func (c Config) QuarantineRetention() (time.Duration, error)

QuarantineRetention is storage.quarantineRetention parsed, how long the start-up reclaims keep the data no object names (ADR-0288): DefaultQuarantineRetention when empty; fault.Invalid naming the key for a value that is no ADR-0194 duration or lies below MinQuarantineRetention.

func (Config) ResolveKVBackup added in v0.10.0 

func (c Config) ResolveKVBackup() (KVBackup, error)

ResolveKVBackup takes each group whole from kvstore.backup when its lead key is set there, else from backup:. A credentialsFile or singleWriter without the KV's own target, a KV target equal to backup.target, no target in either block, or no recipients and no none in either block is fault.Invalid naming the key.

func (Config) StorageMinFreeBytes added in v0.34.0 

func (c Config) StorageMinFreeBytes() (int64, error)

StorageMinFreeBytes is storage.minFreeSize in bytes: empty is DefaultStorageMinFreeSize, and 0 turns the floor off. fault.Invalid names the key for a size that does not parse.

func (Config) Validate 

func (c Config) Validate() error

Validate runs the struct's `validate` tags (go-playground/validator) over the merged values, returning a fault.Invalid naming the offending yaml key + the allowed set. Load calls it on the effective config (so a bad value from the file, a FUNCD_* env, or the flag is all caught — the ADR-0061 env edge is closed); it is exported so a caller can validate a hand-built Config.

func (Config) WorkloadBackupMaxListedKeyBytes added in v0.38.0 

func (c Config) WorkloadBackupMaxListedKeyBytes() (int64, error)

WorkloadBackupMaxListedKeyBytes is workloadBackup.maxListedKeySize in bytes; empty, its default. fault.Invalid names the key for a size that does not parse or is zero.

type Credential added in v0.4.0 

type Credential struct {
	TokenFile  string   `` /* 362-byte string literal not displayed */
	Role       string   `` /* 231-byte string literal not displayed */
	Namespaces []string `` /* 212-byte string literal not displayed */
}

Credential is one auth.credentials entry: the token lives in TokenFile, never in the config.

type CredentialList added in v0.4.0 

type CredentialList []Credential

CredentialList is auth.credentials (ADR-0171): nil means the key is absent. UnmarshalJSON makes a present key non-nil, null included, and refuses an unknown entry key, which yaml.UnmarshalStrict does not check below a custom unmarshaler.

func (*CredentialList) UnmarshalJSON added in v0.4.0 

func (l *CredentialList) UnmarshalJSON(b []byte) error

UnmarshalJSON decodes the list strictly, naming the entry index in an error.

type Finding added in v0.10.0 

type Finding struct {
	Key, Message string
	Error        bool
}

Finding is one outcome of CheckBackup (ADR-0205 Decision 3): Key is the first key its rule names and Message names every key; Error refuses the start, else it is a warning.

type Flags 

type Flags struct{ MemoryOnly *bool }

Flags are the top precedence tier (CLI flags with no env). MemoryOnly nil ⇒ --memory not set.

type KVBackup added in v0.10.0 

type KVBackup struct {
	Target, CredentialsFile    string
	SingleWriter, Shared, None bool
	Recipients                 []string
}

KVBackup is kvstore.backup after ADR-0209 Decision 1: the target group (Target, CredentialsFile, SingleWriter) and the encryption group (None, Recipients). Shared is true when the target group is backup:'s.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.