Module cluster_controller 

Driver and glue for the mz_cluster_controller reconciler.

The controller crate is pure: it knows nothing about the Coordinator. This module is the half of the ClusterControllerCtx boundary that does: it runs the controller as a separate task and implements the ctx by marshaling each pull/apply to the Coordinator over the internal command channel, because the catalog and the live compute/storage signals are reachable only from the coordinator loop. Whole-tick reads are batched. Refresh-window catalog inputs are pulled one cluster at a time and completed with one shared oracle read. The remaining per-cluster live signals are pulled on demand, so steady clusters do not pay for signals they do not use.

The controller owns the replica set of every managed cluster, user and system alike. A builtin cluster’s config-implied replicas are additionally materialized by reconcile_builtin_cluster_replicas at catalog open, which derives the same target from the same config, so the two converge rather than compete.

Structs

CoordCtx 🔒

The controller-task side of the boundary: a ClusterControllerCtx that marshals every call to the Coordinator over internal_cmd_tx.

ReplicaHydrationCheck 🔒

Enums

ClusterControllerRequest

A request the controller task marshals to the Coordinator to satisfy one ClusterControllerCtx call. Each variant carries a oneshot for the reply.

Functions

audit_reason_for_create 🔒

Map a create decision’s CreateReason to the audit reason carried on the create event. Baseline audits ReplicaCreateDropReason::Manual, the tag for replicas the user’s own cluster config calls for. The match is exhaustive, so a new CreateReason variant is a compile error here instead of a silent Manual.

memory_burst 🔒

memory_reconfiguration 🔒

on_timeout_from_controller 🔒

replica_shape 🔒

Map an in-memory replica config to a ReplicaShape, or None for an unmanaged replica (which the controller does not own).

status_from_controller 🔒