Module cluster_controller 

Driver and glue for the mz_cluster_controller reconciler.

The controller crate is pure: it knows nothing about the Coordinator. This module is the half of the ClusterControllerCtx boundary that does: it runs the controller as a separate task and implements the ctx by marshaling each pull/apply to the Coordinator over the internal command channel, because the catalog and the live compute/storage signals are reachable only from the coordinator loop. The two whole-tick reads are batched; the per-cluster live signals are pulled on demand, so a tick’s round-trips scale with the number of managed clusters that need a live signal, not with a constant.

Everything here is gated by ENABLE_CLUSTER_CONTROLLER (default on). With the gate off the task does not tick, so the legacy scheduling and graceful paths remain the sole writers of the replica set. With the gate on the controller owns the user managed-cluster replica set; the legacy entry points no-op. (System/builtin clusters are excluded here. Their config-implied replicas are materialized by reconcile_builtin_cluster_replicas at catalog open, which derives the same target from the same config.)

Structs

CoordCtx 🔒

The controller-task side of the boundary: a ClusterControllerCtx that marshals every call to the Coordinator over internal_cmd_tx.

ReplicaHydrationCheck 🔒

Enums

ClusterControllerRequest

A request the controller task marshals to the Coordinator to satisfy one ClusterControllerCtx call. Each variant carries a oneshot for the reply.

Functions

audit_reason_for_create 🔒

Map a create decision’s CreateReason to the audit reason carried on the create event. Baseline audits ReplicaCreateDropReason::Manual, the tag for replicas the user’s own cluster config calls for. The match is exhaustive, so a new CreateReason variant is a compile error here instead of a silent Manual.

memory_burst 🔒

memory_reconfiguration 🔒

on_timeout_from_controller 🔒

replica_shape 🔒

Map an in-memory replica config to a ReplicaShape, or None for an unmanaged replica (which the controller does not own).

status_from_controller 🔒