postgres

package
v1.8.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 20, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Documentation

Overview

Package postgres implements store.Store using the Grove ORM with pgdriver.

Index

Constants

View Source 
const DefaultLeaderLock = "ctrlplane-scheduler"

DefaultLeaderLock is the advisory lock name the extension's leader election uses when you do not pick one.

Variables

View Source 
var Migrations = migrate.NewGroup("ctrlplane")

Migrations is the grove migration group for the CtrlPlane store.

Functions

This section is empty.

Types

type LeaderElector added in v1.8.0 

type LeaderElector struct {
	// contains filtered or unexported fields
}

LeaderElector elects one leader among replicas that share a Postgres database, using a session-level advisory lock. It satisfies worker.LeaderElector.

The leader keeps one pooled connection checked out for as long as it leads, because the lock lives exactly as long as that session. If the connection dies, Postgres drops the lock and another replica takes it on its next check.

func NewLeaderElector added in v1.8.0 

func NewLeaderElector(db *grove.DB, lock string) *LeaderElector

NewLeaderElector returns an elector over the advisory lock named lock. Replicas that should elect one leader between them must use the same name.

func (*LeaderElector) IsLeader added in v1.8.0 

func (e *LeaderElector) IsLeader(ctx context.Context) (bool, error)

IsLeader reports whether this replica holds the lock, trying to take it when it does not. While the lock is held it costs one round trip on the held connection.

func (*LeaderElector) Resign added in v1.8.0 

func (e *LeaderElector) Resign(ctx context.Context) error

Resign releases the lock and returns the connection to the pool. It is a no-op when this replica is not the leader.

type Store 

type Store struct {
	*managedstate.Repository
	// contains filtered or unexported fields
}

Store implements store.Store using grove ORM with pgdriver.

func New 

func New(db *grove.DB) *Store

New creates a new PostgreSQL-backed store.

func NewWithWriterFloorAdmission added in v1.8.0 

func NewWithWriterFloorAdmission(db *grove.DB, authority string) (*Store, error)

NewWithWriterFloorAdmission selects protected managed-mutation admission before publishing the store. New retains legacy behavior. Protected deployments must exclude legacy constructors/binaries through their host admission and credentials. Missing protected tables or SELECT grants refuse; this constructor installs neither.

func (*Store) Close 

func (s *Store) Close() error

Close closes the database connection.

func (*Store) CountByTenant added in v0.1.0 

func (s *Store) CountByTenant(ctx context.Context, tenantID string) (int, error)

func (*Store) CountDatacentersByTenant added in v1.3.0 

func (s *Store) CountDatacentersByTenant(ctx context.Context, tenantID string) (int, error)

CountDatacentersByTenant returns the total number of datacenters for a tenant.

func (*Store) CountDomainsByTenant added in v0.1.0 

func (s *Store) CountDomainsByTenant(ctx context.Context, tenantID string) (int, error)

func (*Store) CountInstancesByDatacenter added in v1.3.0 

func (s *Store) CountInstancesByDatacenter(ctx context.Context, tenantID string, datacenterID id.ID) (int, error)

CountInstancesByDatacenter returns the number of instances linked to a datacenter.

func (*Store) CountSecretsByTenant added in v0.1.0 

func (s *Store) CountSecretsByTenant(ctx context.Context, tenantID string) (int, error)

func (*Store) CountTenants added in v0.1.0 

func (s *Store) CountTenants(ctx context.Context) (int, error)

func (*Store) CountTenantsByStatus added in v0.1.0 

func (s *Store) CountTenantsByStatus(ctx context.Context, status admin.TenantStatus) (int, error)

func (*Store) DB added in v0.1.0 

func (s *Store) DB() *grove.DB

DB returns the underlying grove database for direct access.

func (*Store) Delete added in v0.1.0 

func (s *Store) Delete(ctx context.Context, tenantID string, instanceID id.ID) error

func (*Store) DeleteBootstrap added in v1.5.1 

func (s *Store) DeleteBootstrap(ctx context.Context, bootstrapID id.ID) error

DeleteBootstrap removes a row. Idempotent: a delete against a non-existent ID returns nil, matching the in-memory store's reconciler-friendly contract.

func (*Store) DeleteCertificate added in v0.1.0 

func (s *Store) DeleteCertificate(ctx context.Context, tenantID string, certID id.ID) error

func (*Store) DeleteCheck added in v0.1.0 

func (s *Store) DeleteCheck(ctx context.Context, tenantID string, checkID id.ID) error

func (*Store) DeleteDatacenter added in v1.3.0 

func (s *Store) DeleteDatacenter(ctx context.Context, tenantID string, datacenterID id.ID) error

DeleteDatacenter removes a datacenter from the store.

func (*Store) DeleteDomain added in v0.1.0 

func (s *Store) DeleteDomain(ctx context.Context, tenantID string, domainID id.ID) error

func (*Store) DeleteRoute added in v0.1.0 

func (s *Store) DeleteRoute(ctx context.Context, tenantID string, routeID id.ID) error

func (*Store) DeleteSecret added in v0.1.0 

func (s *Store) DeleteSecret(ctx context.Context, tenantID string, instanceID id.ID, key string) error

func (*Store) DeleteTemplate added in v1.3.0 

func (s *Store) DeleteTemplate(ctx context.Context, tenantID string, templateID id.ID) error

DeleteTemplate removes a template.

func (*Store) DeleteTenant added in v0.1.0 

func (s *Store) DeleteTenant(ctx context.Context, tenantID string) error

func (*Store) DeleteWorkload added in v1.5.1 

func (s *Store) DeleteWorkload(ctx context.Context, tenantID string, workloadID id.ID) error

DeleteWorkload removes a workload row. Replica Instances are not touched here — workload.Service.Delete cascades by deleting instances first.

func (*Store) GetBootstrap added in v1.5.1 

func (s *Store) GetBootstrap(ctx context.Context, bootstrapID id.ID) (*bootstrap.BootstrapWorkload, error)

GetBootstrap retrieves a bootstrap workload by ID.

func (*Store) GetBootstrapByName added in v1.5.1 

func (s *Store) GetBootstrapByName(ctx context.Context, datacenterID id.ID, name string) (*bootstrap.BootstrapWorkload, error)

GetBootstrapByName retrieves the row whose (DatacenterID, Name) pair matches. ErrNotFound when no row matches.

func (*Store) GetByID added in v0.1.0 

func (s *Store) GetByID(ctx context.Context, tenantID string, instanceID id.ID) (*instance.Instance, error)

func (*Store) GetBySlug added in v0.1.0 

func (s *Store) GetBySlug(ctx context.Context, tenantID string, slug string) (*instance.Instance, error)

func (*Store) GetCertificate added in v0.1.0 

func (s *Store) GetCertificate(ctx context.Context, tenantID string, certID id.ID) (*network.Certificate, error)

func (*Store) GetCheck added in v0.1.0 

func (s *Store) GetCheck(ctx context.Context, tenantID string, checkID id.ID) (*health.HealthCheck, error)

func (*Store) GetDatacenterByID added in v1.3.0 

func (s *Store) GetDatacenterByID(ctx context.Context, tenantID string, datacenterID id.ID) (*datacenter.Datacenter, error)

GetDatacenterByID retrieves a datacenter by ID. Returns the DC when it belongs to tenantID OR when it's platform-shared (TenantID = ”).

func (*Store) GetDatacenterBySlug added in v1.3.0 

func (s *Store) GetDatacenterBySlug(ctx context.Context, tenantID string, slug string) (*datacenter.Datacenter, error)

GetDatacenterBySlug retrieves a datacenter by slug. Tenant-scoped hits take precedence over platform-shared ones with the same slug.

func (*Store) GetDeployment added in v0.1.0 

func (s *Store) GetDeployment(ctx context.Context, tenantID string, deployID id.ID) (*deploy.Deployment, error)

func (*Store) GetDomain added in v0.1.0 

func (s *Store) GetDomain(ctx context.Context, tenantID string, domainID id.ID) (*network.Domain, error)

func (*Store) GetDomainByHostname added in v0.1.0 

func (s *Store) GetDomainByHostname(ctx context.Context, hostname string) (*network.Domain, error)

func (*Store) GetLatestResourceSnapshot added in v0.1.0 

func (s *Store) GetLatestResourceSnapshot(ctx context.Context, tenantID string, instanceID id.ID) (*telemetry.ResourceSnapshot, error)

func (*Store) GetLatestResult added in v0.1.0 

func (s *Store) GetLatestResult(ctx context.Context, tenantID string, checkID id.ID) (*health.HealthResult, error)

func (*Store) GetRelease added in v0.1.0 

func (s *Store) GetRelease(ctx context.Context, tenantID string, releaseID id.ID) (*deploy.Release, error)

func (*Store) GetRoute added in v0.1.0 

func (s *Store) GetRoute(ctx context.Context, tenantID string, routeID id.ID) (*network.Route, error)

func (*Store) GetSecretByKey added in v0.1.0 

func (s *Store) GetSecretByKey(ctx context.Context, tenantID string, instanceID id.ID, key string) (*secrets.Secret, error)

func (*Store) GetTemplate added in v1.3.0 

func (s *Store) GetTemplate(ctx context.Context, tenantID string, templateID id.ID) (*template.Template, error)

GetTemplate retrieves a workload template by ID within a tenant.

func (*Store) GetTenant added in v0.1.0 

func (s *Store) GetTenant(ctx context.Context, tenantID string) (*admin.Tenant, error)

func (*Store) GetTenantByExternalID added in v1.5.1 

func (s *Store) GetTenantByExternalID(ctx context.Context, externalID string) (*admin.Tenant, error)

func (*Store) GetTenantBySlug added in v0.1.0 

func (s *Store) GetTenantBySlug(ctx context.Context, slug string) (*admin.Tenant, error)

func (*Store) GetWorkloadByID added in v1.5.1 

func (s *Store) GetWorkloadByID(ctx context.Context, tenantID string, workloadID id.ID) (*workload.Workload, error)

GetWorkloadByID returns a workload by ID. Empty tenantID is the cross-tenant convention used by admin views.

func (*Store) GetWorkloadBySlug added in v1.5.1 

func (s *Store) GetWorkloadBySlug(ctx context.Context, tenantID, slug string) (*workload.Workload, error)

GetWorkloadBySlug returns a workload by URL-safe slug within the tenant.

func (*Store) Insert added in v0.1.0 

func (s *Store) Insert(ctx context.Context, inst *instance.Instance) error

func (*Store) InsertAuditEntry added in v0.1.0 

func (s *Store) InsertAuditEntry(ctx context.Context, entry *admin.AuditEntry) error

func (*Store) InsertBootstrap added in v1.5.1 

func (s *Store) InsertBootstrap(ctx context.Context, bw *bootstrap.BootstrapWorkload) error

InsertBootstrap persists a new bootstrap workload row.

The (datacenter_id, name) uniqueness contract is enforced by the `idx_cp_bootstrap_workloads_dc_name` unique index from migration 20240101000021. Duplicates surface as a postgres unique-violation which the bun layer maps to a generic error — the reconciler already handles "row exists" by reading + updating instead, so the rare collision path is benign.

func (*Store) InsertCertificate added in v0.1.0 

func (s *Store) InsertCertificate(ctx context.Context, cert *network.Certificate) error

func (*Store) InsertCheck added in v0.1.0 

func (s *Store) InsertCheck(ctx context.Context, check *health.HealthCheck) error

func (*Store) InsertDatacenter added in v1.3.0 

func (s *Store) InsertDatacenter(ctx context.Context, dc *datacenter.Datacenter) error

InsertDatacenter persists a new datacenter.

func (*Store) InsertDeployment added in v0.1.0 

func (s *Store) InsertDeployment(ctx context.Context, d *deploy.Deployment) error

func (*Store) InsertDomain added in v0.1.0 

func (s *Store) InsertDomain(ctx context.Context, domain *network.Domain) error

func (*Store) InsertLogs added in v0.1.0 

func (s *Store) InsertLogs(ctx context.Context, logs []telemetry.LogEntry) error

func (*Store) InsertMetrics added in v0.1.0 

func (s *Store) InsertMetrics(ctx context.Context, metrics []telemetry.Metric) error

func (*Store) InsertRelease added in v0.1.0 

func (s *Store) InsertRelease(ctx context.Context, r *deploy.Release) error

func (*Store) InsertResourceSnapshot added in v0.1.0 

func (s *Store) InsertResourceSnapshot(ctx context.Context, snap *telemetry.ResourceSnapshot) error

func (*Store) InsertResult added in v0.1.0 

func (s *Store) InsertResult(ctx context.Context, result *health.HealthResult) error

func (*Store) InsertRoute added in v0.1.0 

func (s *Store) InsertRoute(ctx context.Context, route *network.Route) error

func (*Store) InsertSecret added in v0.1.0 

func (s *Store) InsertSecret(ctx context.Context, secret *secrets.Secret) error

func (*Store) InsertTemplate added in v1.3.0 

func (s *Store) InsertTemplate(ctx context.Context, t *template.Template) error

InsertTemplate persists a new workload template.

func (*Store) InsertTenant added in v0.1.0 

func (s *Store) InsertTenant(ctx context.Context, tenant *admin.Tenant) error

func (*Store) InsertTraces added in v0.1.0 

func (s *Store) InsertTraces(ctx context.Context, traces []telemetry.Trace) error

func (*Store) InsertWorkload added in v1.5.1 

func (s *Store) InsertWorkload(ctx context.Context, w *workload.Workload) error

InsertWorkload persists a Workload. The id is a TEXT pk assigned by the caller, so a plain insert is safe (no BIGSERIAL/autoincrement concern).

func (*Store) InspectManagedOwnerProtection added in v1.8.0 

func (s *Store) InspectManagedOwnerProtection(ctx context.Context, key managed.OwnerKey) (managed.Protection, error)

InspectManagedOwnerProtection pages the tenant index and validates every document. Lookup cost grows with retained targets; pages bound decoded memory, not scan cost.

func (*Store) LeaderElector added in v1.8.0 

func (s *Store) LeaderElector(lock string) *LeaderElector

LeaderElector returns an elector over this store's database.

func (*Store) List added in v0.1.0 

func (s *Store) List(ctx context.Context, tenantID string, opts instance.ListOptions) (*instance.ListResult, error)

func (*Store) ListBootstraps added in v1.5.1 

func (s *Store) ListBootstraps(ctx context.Context, datacenterID id.ID) ([]*bootstrap.BootstrapWorkload, error)

ListBootstraps returns every bootstrap workload attached to the given datacenter. Ordered by created_at so the reconciler's per-tick iteration is stable across runs.

func (*Store) ListCertificates added in v0.1.0 

func (s *Store) ListCertificates(ctx context.Context, tenantID string, instanceID id.ID) ([]network.Certificate, error)

func (*Store) ListCertificatesByDomain added in v0.1.0 

func (s *Store) ListCertificatesByDomain(ctx context.Context, tenantID string, domainID id.ID) ([]network.Certificate, error)

func (*Store) ListChecks added in v0.1.0 

func (s *Store) ListChecks(ctx context.Context, tenantID string, instanceID id.ID) ([]health.HealthCheck, error)

func (*Store) ListDatacenters added in v1.3.0 

func (s *Store) ListDatacenters(ctx context.Context, tenantID string, opts datacenter.ListOptions) (*datacenter.ListResult, error)

ListDatacenters returns datacenters visible to tenantID — both tenant-owned and platform-shared (TenantID = ”).

func (*Store) ListDeployments added in v0.1.0 

func (s *Store) ListDeployments(ctx context.Context, tenantID string, instanceID id.ID, opts deploy.ListOptions) (*deploy.DeployListResult, error)

func (*Store) ListDomains added in v0.1.0 

func (s *Store) ListDomains(ctx context.Context, tenantID string, instanceID id.ID) ([]network.Domain, error)

func (*Store) ListReleases added in v0.1.0 

func (s *Store) ListReleases(ctx context.Context, tenantID string, instanceID id.ID, opts deploy.ListOptions) (*deploy.ReleaseListResult, error)

func (*Store) ListResourceSnapshots added in v0.1.0 

func (s *Store) ListResourceSnapshots(ctx context.Context, tenantID string, instanceID id.ID, opts telemetry.TimeRange) ([]telemetry.ResourceSnapshot, error)

func (*Store) ListResults added in v0.1.0 

func (s *Store) ListResults(ctx context.Context, tenantID string, checkID id.ID, opts health.HistoryOptions) ([]health.HealthResult, error)

func (*Store) ListRoutes added in v0.1.0 

func (s *Store) ListRoutes(ctx context.Context, tenantID string, instanceID id.ID) ([]network.Route, error)

func (*Store) ListSecrets added in v0.1.0 

func (s *Store) ListSecrets(ctx context.Context, tenantID string, instanceID id.ID) ([]secrets.Secret, error)

func (*Store) ListTemplates added in v1.3.0 

func (s *Store) ListTemplates(ctx context.Context, tenantID string, opts template.ListOptions) (*template.ListResult, error)

ListTemplates returns a paginated list of templates for a tenant.

func (*Store) ListTenants added in v0.1.0 

func (s *Store) ListTenants(ctx context.Context, opts admin.ListTenantsOptions) (*admin.TenantListResult, error)

func (*Store) ListWorkloads added in v1.5.1 

func (s *Store) ListWorkloads(ctx context.Context, tenantID string, opts workload.ListOptions) (*workload.ListResult, error)

ListWorkloads returns workloads matching the filter. Empty tenantID = a cross-tenant view. Each conditional clause continues the positional placeholder index ($1, $2, …) so the args line up — restarting at $1 per clause is the placeholder-reuse bug.

func (*Store) Migrate 

func (s *Store) Migrate(ctx context.Context) error

Migrate creates the required tables and indexes using the grove orchestrator.

func (*Store) NextReleaseVersion added in v0.1.0 

func (s *Store) NextReleaseVersion(ctx context.Context, tenantID string, instanceID id.ID) (int, error)

func (*Store) Ping 

func (s *Store) Ping(ctx context.Context) error

Ping checks database connectivity.

func (*Store) QueryAuditLog added in v0.1.0 

func (s *Store) QueryAuditLog(ctx context.Context, opts admin.AuditQuery) (*admin.AuditResult, error)

func (*Store) QueryLogs added in v0.1.0 

func (s *Store) QueryLogs(ctx context.Context, q telemetry.LogQuery) ([]telemetry.LogEntry, error)

func (*Store) QueryMetrics added in v0.1.0 

func (s *Store) QueryMetrics(ctx context.Context, q telemetry.MetricQuery) ([]telemetry.Metric, error)

func (*Store) QueryTraces added in v0.1.0 

func (s *Store) QueryTraces(ctx context.Context, q telemetry.TraceQuery) ([]telemetry.Trace, error)

func (*Store) Update added in v0.1.0 

func (s *Store) Update(ctx context.Context, inst *instance.Instance) error

func (*Store) UpdateBootstrap added in v1.5.1 

func (s *Store) UpdateBootstrap(ctx context.Context, bw *bootstrap.BootstrapWorkload) error

UpdateBootstrap persists changes to an existing row. UpdatedAt is stamped on every save so dashboard sort-by-recently-touched is meaningful.

func (*Store) UpdateCertificate added in v0.1.0 

func (s *Store) UpdateCertificate(ctx context.Context, cert *network.Certificate) error

func (*Store) UpdateCheck added in v0.1.0 

func (s *Store) UpdateCheck(ctx context.Context, check *health.HealthCheck) error

func (*Store) UpdateDatacenter added in v1.3.0 

func (s *Store) UpdateDatacenter(ctx context.Context, dc *datacenter.Datacenter) error

UpdateDatacenter persists changes to an existing datacenter.

func (*Store) UpdateDeployment added in v0.1.0 

func (s *Store) UpdateDeployment(ctx context.Context, d *deploy.Deployment) error

func (*Store) UpdateDomain added in v0.1.0 

func (s *Store) UpdateDomain(ctx context.Context, domain *network.Domain) error

func (*Store) UpdateRoute added in v0.1.0 

func (s *Store) UpdateRoute(ctx context.Context, route *network.Route) error

func (*Store) UpdateSecret added in v0.1.0 

func (s *Store) UpdateSecret(ctx context.Context, secret *secrets.Secret) error

func (*Store) UpdateTemplate added in v1.3.0 

func (s *Store) UpdateTemplate(ctx context.Context, t *template.Template) error

UpdateTemplate persists changes to an existing template.

func (*Store) UpdateTenant added in v0.1.0 

func (s *Store) UpdateTenant(ctx context.Context, tenant *admin.Tenant) error

func (*Store) UpdateWorkload added in v1.5.1 

func (s *Store) UpdateWorkload(ctx context.Context, w *workload.Workload) error

UpdateWorkload persists changes only within the workload's owning tenant.

type WriterFloorAdmin added in v1.8.0 

type WriterFloorAdmin struct {
	// contains filtered or unexported fields
}

WriterFloorAdmin uses an explicitly supplied administrative connection. It must use credentials unavailable to runtime hosts, with authority DML already fenced. Construction cannot prove credential separation, network custody or deployment admission.

func NewWriterFloorAdmin added in v1.8.0 

func NewWriterFloorAdmin(adminDB *grove.DB, authority string) (*WriterFloorAdmin, error)

NewWriterFloorAdmin requires a dedicated administrative database handle. The caller is responsible for actual PostgreSQL role isolation and the external barrier. Ordinary Store and controller transaction values do not implement this capability.

func NewWriterFloorExclusionAdmin added in v1.8.0 

func NewWriterFloorExclusionAdmin(db *grove.DB, authority string, policy WriterFloorExclusionPolicy) (*WriterFloorAdmin, error)

NewWriterFloorExclusionAdmin opts a dedicated admin handle into atomic grant revocation and floor activation. Its connection must have session_user AdminRole and current_user OwnerRole on every acquired connection. Runtime constructors and the existing floor administrator keep their existing installation behavior. The launcher must first close admission, disable these logins and drain sessions. Construction does not verify those facts; activation checks the installed catalog.

func (*WriterFloorAdmin) Activate added in v1.8.0 

func (a *WriterFloorAdmin) Activate(ctx context.Context, request managed.WriterFloorActivation) (managed.WriterFloor, error)

Activate atomically retains a floor activation. It does not reopen traffic or certify a writer.

func (*WriterFloorAdmin) Migrate added in v1.8.0 

func (a *WriterFloorAdmin) Migrate(ctx context.Context) error

Migrate installs protected tables through the separately supplied administrative DB. You must provision and verify runtime SELECT-only grants separately, including inherited roles, owners and default ACLs. This migration cannot certify deployment custody.

type WriterFloorExclusionPolicy added in v1.8.0 

type WriterFloorExclusionPolicy struct {
	OwnerRole     string
	AdminRole     string
	ExcludedRoles []string
	// AdditionalTables lists exact reviewed Grove bookkeeping tables in public.
	// Unknown catalog objects refuse; this is not a wildcard or a discovery result.
	AdditionalTables []string
}

WriterFloorExclusionPolicy is trusted deployment configuration for a dedicated authority database. It is never accepted from a managed command or HTTP request. Every retired writer, history and current runtime principal belongs in ExcludedRoles. This disabled-protocol cutover grants none of them authority DML.

type WriterFloorReader added in v1.8.0 

type WriterFloorReader struct {
	*managedstate.WriterFloorReader
}

WriterFloorReader exposes protected inspection without floor administration.

func NewWriterFloorReader added in v1.8.0 

func NewWriterFloorReader(db *grove.DB, authority string) (*WriterFloorReader, error)

NewWriterFloorReader binds read-only inspection to the host's configured authority. The supplied database role needs SELECT on both protected tables, and no floor DML.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.