checks

type Checker ¶

type Checker interface {
	Check(ctx context.Context) Result
	Type() string
}

func NewChecker(cfg *config.CheckConfig) (Checker, error)

type DNSChecker ¶

type DNSChecker struct {
	// contains filtered or unexported fields
}

func NewDNSChecker(cfg *config.DNSCheckConfig) *DNSChecker

func (c *DNSChecker) Check(ctx context.Context) Result

func (c *DNSChecker) Type() string

type GRPCChecker ¶ added in v0.5.0

type GRPCChecker struct {
	// contains filtered or unexported fields
}

GRPCChecker performs a gRPC health check.

When cfg.Method is empty it uses the standard gRPC Health Checking Protocol (grpc.health.v1.Health/Check) and requires the response status to be SERVING.

When cfg.Method is set it calls that unary RPC with an empty proto3 request and considers the call passing if the returned gRPC status code is in OKCodes (default: OK). This mirrors the HTTP checker's response_codes semantics.

func NewGRPCChecker(cfg *config.GRPCCheckConfig) (*GRPCChecker, error)

func (c *GRPCChecker) Check(ctx context.Context) Result

func (c *GRPCChecker) Type() string

type HTTPChecker ¶

type HTTPChecker struct {
	// contains filtered or unexported fields
}

func NewHTTPChecker(cfg *config.HTTPCheckConfig) (*HTTPChecker, error)

func (c *HTTPChecker) Check(ctx context.Context) Result

func (c *HTTPChecker) Type() string

type HealthTransition ¶

type HealthTransition struct {
	Ctx         context.Context // trace context; may be nil when called synthetically
	VIPName     string
	CheckName   string // which of the VIP's checks crossed the threshold
	Healthy     bool
	Reason      string
	CheckResult Result
}

HealthTransition is fired when a VIP crosses the rise or fall threshold. Ctx carries the trace context of the check that caused the transition so that downstream operations (e.g. BGP announce/withdraw) appear as child spans.

type KafkaChecker ¶ added in v0.13.0

type KafkaChecker struct {
	// contains filtered or unexported fields
}

KafkaChecker connects to a Kafka broker, negotiates API versions (and TLS and SASL when configured) and asks for cluster metadata. The check passes when the broker answers with at least min_brokers live brokers and, if a topic is configured, that topic exists and every partition has a leader.

func NewKafkaChecker(cfg *config.KafkaCheckConfig) (*KafkaChecker, error)

func (c *KafkaChecker) Check(ctx context.Context) Result

func (c *KafkaChecker) Type() string

type ListenChecker ¶ added in v0.13.0

type ListenChecker struct {
	// contains filtered or unexported fields
}

ListenChecker passes when a local socket is bound to the configured port: a TCP socket in LISTEN state, or any bound UDP socket. It reads the kernel socket tables (net/tcp, tcp6, udp, udp6 under procfs) and sends nothing, which makes it suitable for services that log every unexpected datagram (IPFIX, syslog, ...).

/proc/net is a symlink to /proc/self/net, so by default the check sees the network namespace pathosd runs in. With NetnsPID set it reads <procfs>/<pid>/net instead, the namespace of that process, which is how a container with the host's /proc mounted at /host/proc observes the host.

func NewListenChecker(cfg *config.ListenCheckConfig) *ListenChecker

func (c *ListenChecker) Check(_ context.Context) Result

func (c *ListenChecker) Type() string

type LocalAddress ¶ added in v0.12.0

type LocalAddress struct {
	Interface string
	Addr      netip.Addr
}

LocalAddress is one address configured on a local interface.

func ListLocalAddresses() ([]LocalAddress, error)

type LocalAddressGuard ¶ added in v0.12.0

type LocalAddressGuard struct {
	// contains filtered or unexported fields
}

LocalAddressGuard reports failure while the VIP address is not configured on a local interface (optionally a specific one), so the route is never announced for an address this host cannot serve. One guard serves all checks of a VIP: Wrap returns a Checker that runs the inner check only once the address is present, and state-change logging happens once per VIP.

func NewLocalAddressGuard(vipName, prefix, iface string, onState func(assigned bool)) (*LocalAddressGuard, error)

func (g *LocalAddressGuard) Wrap(inner Checker) Checker

type PingChecker ¶

type PingChecker struct {
	// contains filtered or unexported fields
}

func NewPingChecker(cfg *config.PingCheckConfig) *PingChecker

func (c *PingChecker) Check(ctx context.Context) Result

func (c *PingChecker) Type() string

type Registry ¶ added in v0.14.0

type Registry struct {
	// contains filtered or unexported fields
}

Registry owns the goroutines of every scheduler the daemon runs and is the source of the per-VIP scheduler list the HTTP API shows. Schedulers can be added, removed and replaced while the daemon runs, which is how a config reload swaps checks without restarting.

A shadow scheduler runs like any other but is not listed: a reload starts the new definition of a changed check in shadow and promotes it once it reached a verdict, so the old check keeps governing the VIP until then.

func NewRegistry() *Registry

func (r *Registry) Add(s *Scheduler)

func (r *Registry) AddShadow(s *Scheduler)

func (r *Registry) Promote(s *Scheduler) *Scheduler

func (r *Registry) Remove(s *Scheduler)

func (r *Registry) RemoveVIP(vip string)

func (r *Registry) Schedulers() map[string][]*Scheduler

func (r *Registry) Start()

func (r *Registry) Stop(ctx context.Context) error

type Result ¶

type Result struct {
	Success  bool          `json:"success"`
	Detail   string        `json:"detail"`
	Duration time.Duration `json:"duration"`
	Err      error         `json:"-"`
	TimedOut bool          `json:"timed_out,omitempty"`
	// Details holds check-type-specific observations (status code, RTTs,
	// rcode, ...) when the backend got far enough to produce them.
	Details model.CheckDetails `json:"details,omitempty"`
}

type SQLChecker ¶ added in v0.13.0

type SQLChecker struct {
	// contains filtered or unexported fields
}

SQLChecker connects to a MySQL/MariaDB or PostgreSQL server and runs the configured queries in order on one connection. Each query must succeed; when it carries a result_jq expression the rows (as a JSON array of column→value objects) must make the expression true. Replication lag, read-only state or any other condition is expressed as a query plus jq, so nothing about the schema is hard-coded.

func NewSQLChecker(cfg *config.SQLCheckConfig) (*SQLChecker, error)

func (c *SQLChecker) Check(ctx context.Context) Result

func (c *SQLChecker) Type() string

type Scheduler ¶

type Scheduler struct {
	// contains filtered or unexported fields
}

func NewScheduler(cfg SchedulerConfig) *Scheduler

func (s *Scheduler) CheckName() string

func (s *Scheduler) ConsecutiveFail() int

func (s *Scheduler) ConsecutiveOK() int

func (s *Scheduler) Fall() int

func (s *Scheduler) IsHealthy() bool

func (s *Scheduler) LastResult() Result

func (s *Scheduler) Rise() int

func (s *Scheduler) Run(ctx context.Context)

func (s *Scheduler) SetCallbacks(onTransition func(HealthTransition), onCheckResult func(vipName, checkName string, result Result))

func (s *Scheduler) TriggerCheck(ctx context.Context) (Result, error)

func (s *Scheduler) VIPName() string

type SchedulerConfig ¶

type SchedulerConfig struct {
	VIPName string
	// CheckName identifies the check within the VIP; defaults to the checker type.
	CheckName     string
	Checker       Checker
	Interval      time.Duration
	Timeout       time.Duration
	Rise          int
	Fall          int
	OnTransition  func(HealthTransition)
	OnCheckResult func(vipName, checkName string, result Result)
}

type TCPChecker ¶ added in v0.3.0

type TCPChecker struct {
	// contains filtered or unexported fields
}

TCPChecker dials host:port over TCP. A successful connection means the port is open and accepting connections; the connection is closed immediately after.

func NewTCPChecker(cfg *config.TCPCheckConfig) *TCPChecker

func (c *TCPChecker) Check(ctx context.Context) Result

func (c *TCPChecker) Type() string

type UDPChecker ¶ added in v0.3.0

type UDPChecker struct {
	// contains filtered or unexported fields
}

UDPChecker probes a UDP port by sending a small datagram and waiting for an ICMP port-unreachable reply. On Linux, when a UDP socket is connected and a datagram is sent to a port with no listener, the kernel delivers the ICMP error back to the socket as ECONNREFUSED on the next I/O call — without requiring elevated privileges or raw sockets.

Decision logic:

• ECONNREFUSED on read → nothing is listening → check fails
• Read timeout (no ICMP received) → datagram was accepted → check passes
• Actual data received → server responded → check passes

func NewUDPChecker(cfg *config.UDPCheckConfig) *UDPChecker

func (c *UDPChecker) Check(ctx context.Context) Result

func (c *UDPChecker) Type() string