Struct ClusterController 

pub struct ClusterController {
    pub(crate) strategies: Vec<Box<dyn Strategy>>,
}

The cluster controller. Holds the (stateless) set of strategies and drives a reconcile tick against a ClusterControllerCtx.

Fields

strategies: Vec<Box<dyn Strategy>>

Implementations

impl ClusterController

pub fn new() -> Self

A controller with the implicit baseline and the graceful-reconfiguration strategy. The baseline holds the steady set. Graceful engages only while a reconfiguration record is in flight.

pub async fn reconcile(&self, ctx: &mut dyn ClusterControllerCtx)

Run one reconcile tick over every managed cluster the ctx reports.

See the module docs for the two-phase structure. Both phases apply per cluster, so a compare-and-append rejection on one cluster never blocks progress on the others.

pub(crate) fn shed_decision(state: &ClusterState) -> Option<Decision>

The decision that sheds this cluster’s most expendable transient strategy after a resource-exhausted apply, or None if nothing sheddable is active.

The strategy to shed is chosen by presence, ranked by expendability, not by which create failed: validation is aggregate, and the strategy worth giving up may be one whose replicas already materialized rather than one in the failed batch. The graceful reconfiguration is the most expendable: a discretionary user change that fails cleanly (audited, and the wait-shim reports a timeout) and can be retried, while aborting it leaves the cluster running at its realized shape. The baseline is never shed, it is the committed floor.

We shed one strategy per exhausted apply. If that was not enough, the next tick recomputes and sheds the next one.

pub(crate) fn merge_state_writes( &self, state: &ClusterState, signals: &LiveSignals, now: Timestamp, ) -> StateWrite

Merge every strategy’s Strategy::update_state for one cluster into the single StateWrite the tick applies under one compare-and-append.

The merge is a per-field join, independent of the order strategies run in: a field set by exactly one strategy is taken as-is, a field no strategy sets is left unchanged, and a field set to the same value by several is that value.

Two strategies setting one field to different values is a conflict. Every field is owned by exactly one strategy, so by design it cannot happen and the merge is really a disjoint union. We treat a conflict as an invariant violation rather than a condition to resolve: there is no safety-meaningful winner to pick for a contended size or record, so we trip soft_panic_or_log! (a panic under test/CI soft assertions, a logged error in production) and leave the field unchanged, the only outcome that cannot make things worse. A persistent conflict then freezes that field and keeps tripping the alarm, which is the point: surface the design bug loudly instead of silently picking an arbitrary value.

pub(crate) async fn fetch_signals( &self, ctx: &mut dyn ClusterControllerCtx, states: &[ClusterState], ) -> BTreeMap<ClusterId, LiveSignals>

Fetch the live signals the strategies declared they need for states.

Each strategy names its needs as a pure function of the durable state (Strategy::signal_request), so the kernel stays ignorant of when a strategy engages. Signals are fetched per cluster and only where requested: a steady cluster is never probed, keeping the ctx seam pay-for-what-you-use. The returned map has an entry for every state.

pub(crate) fn collect_replica_decisions( &self, state: &ClusterState, signals: &LiveSignals, now: Timestamp, ) -> Vec<Decision>

Diff the unioned desired set against the actual replicas of one cluster and emit the create/drop decisions that close the gap.

Trait Implementations

impl Default for ClusterController

fn default() -> Self

Returns the “default value” for a type.