sandbox-apiserver: derive the claim TTL from the submitted Sandbox - #5
Merged
Conversation
Create claimed every sandbox with a hardcoded TTL of 0, so the node applied its default lease and every k8s-created sandbox lived exactly five minutes whatever the caller asked for. Nothing is stored on this path - the claim is the node's only chance to hear a lifetime. Create now derives ttl_seconds from spec.shutdownTime (rounded up to whole seconds), or from the sandbox.cocoonstack.io/ttl-seconds annotation for clients that cannot set the field - the same key the vk-cocoon-sandbox provider reads on pods, now defined once in package scale. Unusable lifetimes (a shutdownTime already past, a malformed annotation) are rejected with a 400 before a warm microVM is spent. The node's granted deadline now rides ClaimResult/Assignment back and is reported as spec.shutdownTime on the returned object: the node clamps the ask to its own default and maximum, so the grant - not the echo of the request - is the truth. Verified end-to-end on a two-node test cluster: a 90 s shutdownTime came back verbatim and the node reaped the sandbox five seconds after its deadline.
Test funcs before helpers so the layout gate passes; drop the internal/lifecycle import (TimeLeft with two nil args is t.Sub(now)); math.Ceil for the whole-second round-up; one-arm ShutdownTime echo; comments cut to the budget and the sibling module name corrected.
Only the aggregated apiserver reads the key; the scale definition had no second consumer, so the alias hop bought nothing.
Create no longer rewrites the submitted spec.shutdownTime; the node's granted expiry rides sandbox.cocoonstack.io/deadline beside the claim id and address. InventoryEntry gains an optional deadline so the synthesized Get/List path stamps the identical key once nodes publish it, and a refreshed deadline surfaces as a Modified entry.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The aggregated Create path claimed every sandbox with a hardcoded TTL of 0 (
storage.go:r.store.Claim(ctx, namespace, name, pool, 0)), so sandboxd applied its default lease and every k8s-created Sandbox lived exactly 5 minutes —spec.shutdownTimeand any requested lifetime were silently ignored. Nothing is stored on this path, so the claim body is the only moment the node can hear a lifetime.Change
spec.shutdownTime(the API's own lifecycle field, rounded up to whole seconds) wins; thesandbox.cocoonstack.io/ttl-secondsannotation covers clients that cannot set the field (the same key the vk-sandbox provider reads on pods).shutdownTimealready in the past or a malformed/negative annotation is rejected up front instead of silently claiming with the default lease.ClaimResult.Deadlineis now atime.Timeand ridesAssignment.Deadlinethrough claim / gateway / fork / snapshot-claim; Create stamps it as thesandbox.cocoonstack.io/deadlineannotation (RFC3339) beside the claim id and address, leaving the submitted spec untouched. The node clamps the ask to its own default and maximum, so the grant — not an echo of the request — is what callers see.InventoryEntrygains an optionaldeadlineso the synthesized Get/List path stamps the identical key once nodes publish it (vk-sandbox follow-up), and a refreshed deadline surfaces as a Modified entry.Testing
go test ./...green;make lint(linux + darwin) 0 issues.provider/create.goconsumesClaimResult.Deadlineastime.Time, andinventory/publisher.gofillsInventoryEntry.Deadline.kubectl createwithspec.shutdownTimenow+90s → response carried the granted deadline (verified before the switch to the annotation; unit-tested since); node logreaped expired sandbox …5 s after the deadline, VM process gone.ttl-seconds: "600"→ deadline exactly create+600 s.ttl-seconds: "banana"→ 400, no claim spent.