mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
Aleksei Sviridkin
f668efa116
The binder re-checks what admission checked, and cozystack-api shows the remaining budget a later order is checked against; computing these in three places would let them disagree. The model is pure, so each caller builds a snapshot from its own cache. GPU budgets cap the whole subtree of the tenant that declares them, walked over the namespace ancestry and independent of the tenant quota pools. A raw GPU key blocks a class until the same tenant also declares a GPU key, and then caps devices and raw-name pods together. Pod usage follows the scheduler's arithmetic, sidecars included, so the binder never books a unit a raw-name pod holds. A node takes binds only when it is schedulable, Ready and carries no NoSchedule or NoExecute taint the pod does not tolerate; the unschedulable, not-ready and unreachable taints are left to the first two checks, and a taint never counts as a cordon. Gt and Lt tolerations do not count, since the scheduler ignores them where their feature gate is off. Template device names are derived from the VMI and shortened with a hash when the VMI name leaves no room, so they stay valid subdomains. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
87 lines
2.7 KiB
Go
87 lines
2.7 KiB
Go
/*
|
|
Copyright 2026 The Cozystack Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package model
|
|
|
|
import (
|
|
"github.com/go-logr/logr"
|
|
corev1 "k8s.io/api/core/v1"
|
|
)
|
|
|
|
// Cordoned reports whether the node is cordoned. Only spec.unschedulable
|
|
// counts: a taint, such as the one Fence Agents Remediation sets, is not a
|
|
// cordon and does not trigger the class's onCordon policy.
|
|
func Cordoned(n *corev1.Node) bool {
|
|
return n.Spec.Unschedulable
|
|
}
|
|
|
|
// Ready reports whether the node's Ready condition is True.
|
|
func Ready(n *corev1.Node) bool {
|
|
for _, c := range n.Status.Conditions {
|
|
if c.Type == corev1.NodeReady {
|
|
return c.Status == corev1.ConditionTrue
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// mirrorsCordonOrReadiness reports whether Kubernetes sets the taint for a
|
|
// cordon or a node that is not Ready, which Cordoned and Ready already
|
|
// decide.
|
|
func mirrorsCordonOrReadiness(key string) bool {
|
|
switch key {
|
|
case corev1.TaintNodeUnschedulable, corev1.TaintNodeNotReady, corev1.TaintNodeUnreachable:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// UntoleratedTaint returns the first NoSchedule or NoExecute taint that
|
|
// tolerations do not tolerate, or nil, skipping the taints that mirror a
|
|
// cordon or readiness. Gt and Lt tolerations never match: where their
|
|
// feature gate is off the scheduler does not honour them, and a node is
|
|
// better skipped than bound to in vain.
|
|
func UntoleratedTaint(n *corev1.Node, tolerations []corev1.Toleration) *corev1.Taint {
|
|
for i := range n.Spec.Taints {
|
|
taint := &n.Spec.Taints[i]
|
|
if taint.Effect != corev1.TaintEffectNoSchedule && taint.Effect != corev1.TaintEffectNoExecute {
|
|
continue
|
|
}
|
|
if mirrorsCordonOrReadiness(taint.Key) {
|
|
continue
|
|
}
|
|
tolerated := false
|
|
for j := range tolerations {
|
|
if tolerations[j].ToleratesTaint(logr.Discard(), taint, false) {
|
|
tolerated = true
|
|
break
|
|
}
|
|
}
|
|
if !tolerated {
|
|
return taint
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Eligible reports whether new binds, moves, rebinds and gathers may use
|
|
// the node, and whether its units count in a class's capacity.
|
|
// tolerations are those of the virt-launcher pod, nil when no VMI is
|
|
// known.
|
|
func Eligible(n *corev1.Node, tolerations []corev1.Toleration) bool {
|
|
return !Cordoned(n) && Ready(n) && UntoleratedTaint(n, tolerations) == nil
|
|
}
|