fccf2ab892
Every 30 seconds `workers::swarm_limits` reads the `agent-limits` key of each agent this hive has and stores the result in swarm-resource-limits.json, where the drop-in, the heap ceiling and the dashboard read it. A cap therefore follows its agent to whichever hive runs it. Each value goes through the hive's own validate_cpu_quota / validate_memory_max before it is stored, since hive-priv renders it verbatim into the container's drop-in, and one bad value refuses the whole set (argus on #4268, carried over from the wanted-state consumer this replaces). A failed read, or a bucket that does not answer, leaves the stored caps as they are; three failures in a row raise a banner. swarm-nats-auth grants every hive `$JS.API.DIRECT.GET.KV_agent-limits.>`: read-only, and every agent's key, not just the hive's own. Scoping it to the hive's agents would need a roster in the auth responder, which policy.rs argues against. mara chose this on #4268 (c95293); narrowing it is a possible low-priority follow-up, not planned. A test pins that the grant reads every key, writes none, and reaches no other bucket. Contributes to #3865.
73 lines
2.4 KiB
TOML
73 lines
2.4 KiB
TOML
[package]
|
|
name = "hive-c0re"
|
|
edition.workspace = true
|
|
version.workspace = true
|
|
readme = "README.md"
|
|
|
|
[lints]
|
|
workspace = true
|
|
|
|
[dependencies]
|
|
# For `StreamExt::next` on the swarm-event subscription in `swarm_status`.
|
|
# Workspace-level, same version swarm-controller already uses — not a second copy.
|
|
futures-util.workspace = true
|
|
anyhow.workspace = true
|
|
# Named directly only for the client type the swarm status publisher passes
|
|
# around; the connect itself lives in `swarm-queue-client` below.
|
|
async-nats.workspace = true
|
|
axum.workspace = true
|
|
chrono.workspace = true
|
|
base64.workspace = true
|
|
bcrypt.workspace = true
|
|
reqwest.workspace = true
|
|
forgejo-api.workspace = true
|
|
url.workspace = true
|
|
clap.workspace = true
|
|
clap_complete.workspace = true
|
|
clap-markdown = "0.1"
|
|
# OTEL SDK for the per-agent container-resource metrics exporter
|
|
# (stats/otel_metrics.rs). "internal-logs" on top of the workspace base is
|
|
# this crate's own opt-in: it's not a transport, it's in `default`, and
|
|
# `default-features = false` upstream drops it unless named here.
|
|
opentelemetry.workspace = true
|
|
opentelemetry_sdk.workspace = true
|
|
opentelemetry-otlp = { workspace = true, features = ["internal-logs"] }
|
|
indicatif.workspace = true
|
|
hive-core-agent-sock.workspace = true
|
|
hive-sh4re.workspace = true
|
|
hive-host-sock.workspace = true
|
|
hive-jobq.workspace = true
|
|
hive-jobq-wire.workspace = true
|
|
hive-log.workspace = true
|
|
hive-priv-sock.workspace = true
|
|
hive-types.workspace = true
|
|
libc.workspace = true
|
|
listenfd = "1"
|
|
petgraph.workspace = true
|
|
hmac.workspace = true
|
|
sha2.workspace = true
|
|
rusqlite.workspace = true
|
|
serde.workspace = true
|
|
serde_json.workspace = true
|
|
strum.workspace = true
|
|
# Offering this hive's status to the swarm (`swarm_status`). The same crate
|
|
# the swarm controller reads it with, and `kv` for the same reason: the
|
|
# bucket's name and creation config belong to neither end of it alone.
|
|
swarm-queue-client = { workspace = true, features = [
|
|
"kv",
|
|
"notices",
|
|
"agent-limits",
|
|
] }
|
|
swarm-secret-client.workspace = true
|
|
tokio.workspace = true
|
|
tokio-stream.workspace = true
|
|
tracing.workspace = true
|
|
problem_details = { version = "0.9.0", features = ["axum"] }
|
|
utoipa.workspace = true
|
|
utoipa-axum.workspace = true
|
|
|
|
# `test-util` for `#[tokio::test(start_paused = true)]`: `forge::bounded`'s
|
|
# test asserts the deadline fires without waiting it out.
|
|
[dev-dependencies]
|
|
tempfile = "3"
|
|
tokio = { workspace = true, features = ["test-util"] }
|