mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 19:47:37 +09:00
Aleksei Sviridkin
46ff481549
The binder re-checks what admission checked, and cozystack-api shows the remaining budget a later order is checked against; computing these in three places would let them disagree. The model is pure, so each caller builds a snapshot from its own cache. GPU budgets cap the whole subtree of the tenant that declares them, walked over the namespace ancestry and independent of the tenant quota pools. A raw GPU key blocks a class until the same tenant also declares a GPU key, and then caps claims and raw-name pods together. Pod usage follows the scheduler's arithmetic, sidecars included, so the binder never books a unit a raw-name pod holds. A node serves a class only when it is schedulable, Ready and carries no NoSchedule or NoExecute taint the class does not tolerate. The tolerations are the class's, because a claim is bound before the pod that will use it exists. The unschedulable, not-ready and unreachable taints are left to the first two checks, and a taint never counts as a cordon. Gt and Lt tolerations do not count, since the scheduler ignores them where their feature gate is off. Template claim names are derived from the VMI and shortened with a hash when the VMI name leaves no room, so they stay valid subdomains. Assisted-by: LLM Signed-off-by: Aleksei Sviridkin <f@lex.la>
95 lines
2.9 KiB
Go
95 lines
2.9 KiB
Go
/*
|
|
Copyright 2026 The Cozystack Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package model
|
|
|
|
import (
|
|
"github.com/go-logr/logr"
|
|
corev1 "k8s.io/api/core/v1"
|
|
)
|
|
|
|
// Cordoned reports whether the node is cordoned. Only spec.unschedulable
|
|
// counts: a taint, such as the one Fence Agents Remediation sets, is not a
|
|
// cordon and does not trigger the class's onCordon policy.
|
|
func Cordoned(n *corev1.Node) bool {
|
|
return n.Spec.Unschedulable
|
|
}
|
|
|
|
// Ready reports whether the node's Ready condition is True.
|
|
func Ready(n *corev1.Node) bool {
|
|
for _, c := range n.Status.Conditions {
|
|
if c.Type == corev1.NodeReady {
|
|
return c.Status == corev1.ConditionTrue
|
|
}
|
|
}
|
|
return false
|
|
}
|
|
|
|
// mirrorsCordonOrReadiness reports whether Kubernetes sets the taint for a
|
|
// cordon or a node that is not Ready, which Cordoned and Ready already
|
|
// decide.
|
|
func mirrorsCordonOrReadiness(key string) bool {
|
|
switch key {
|
|
case corev1.TaintNodeUnschedulable, corev1.TaintNodeNotReady, corev1.TaintNodeUnreachable:
|
|
return true
|
|
}
|
|
return false
|
|
}
|
|
|
|
// UntoleratedTaint returns the first NoSchedule or NoExecute taint of the
|
|
// node that class c does not tolerate, or nil, skipping the taints that
|
|
// mirror a cordon or readiness. Gt and Lt tolerations never match: where
|
|
// their feature gate is off the scheduler does not honour them, and a
|
|
// node is better skipped than bound to in vain.
|
|
func UntoleratedTaint(n *corev1.Node, c Class) *corev1.Taint {
|
|
return untoleratedTaint(n.Spec.Taints, c.Tolerations)
|
|
}
|
|
|
|
func untoleratedTaint(taints []corev1.Taint, tolerations []corev1.Toleration) *corev1.Taint {
|
|
for i := range taints {
|
|
taint := &taints[i]
|
|
if taint.Effect != corev1.TaintEffectNoSchedule && taint.Effect != corev1.TaintEffectNoExecute {
|
|
continue
|
|
}
|
|
if mirrorsCordonOrReadiness(taint.Key) {
|
|
continue
|
|
}
|
|
tolerated := false
|
|
for j := range tolerations {
|
|
if tolerations[j].ToleratesTaint(logr.Discard(), taint, false) {
|
|
tolerated = true
|
|
break
|
|
}
|
|
}
|
|
if !tolerated {
|
|
return taint
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Eligible reports whether new binds, moves, rebinds and gathers of
|
|
// claims of class c may use the node, and whether its units count in the
|
|
// class's capacity. A set of claims of several classes may use the node
|
|
// only when it is eligible for each of them.
|
|
func Eligible(n *corev1.Node, c Class) bool {
|
|
return usable(n) && UntoleratedTaint(n, c) == nil
|
|
}
|
|
|
|
func usable(n *corev1.Node) bool {
|
|
return !Cordoned(n) && Ready(n)
|
|
}
|