v0.90.0 — guest RAM resize (R-24) + fast-tick-until-convergence (R-28)
MinAgent coupling: felhom-controller v0.143.0 gates its guest-memory-resize UI on this agent (FeatureGuestMemoryResize, MinAgent 0.90.0). R-24 guest RAM resize (internal/localapi/guestmemory.go): self-scoped GET/POST /guest/memory. Agent enforces every bound FRESH per request (min 2048, max host_total-2048, shrink floor max(2048, usage+512)); applies via PVE SetConfig — live cgroup apply, no reboot (Phase-0 proven on the nested demo box). Verify-after-apply re-reads maxmem before claiming success. New narrow MemoryOps seam (GuestAPI untouched); Options.Memory nil -> 503. Memory only. R-28 fast-tick (internal/fasttick): while any desired-state item is unapplied - including the pre-tunnel window a hub poke can't reach - pulse the shared out-of-band trigger every 30s, self-disarm on convergence. Four cached sources (desired-gen==0, reconcile Planned-Pending>0, pbsdr waiting_secret only, wgtunnel desired-not-operational); LOUD pbsdr states + pending_signature excluded. Seams: reconcile.Engine.LastResult() + wgtunnel.Manager.TunnelConvergence() (cached, no per-tick exec). Guests-0/0: hypothesis REFUTED live (9201 IS a pool member; 0/0 was the pre-provision window; PoolAddVMID re-assert already covers restore-over-existing). No code change; the fast-tick mitigates the window. Tests + red-proofs (i floor guard, ii max guard, iii always-pulse) all restored green.
This commit is contained in:
@@ -0,0 +1,259 @@
|
||||
package localapi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"net/http"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
|
||||
)
|
||||
|
||||
// Guest RAM resize (v0.90.0, R-24 controller-direct). The customer sees the guest's current memory
|
||||
// on the controller's system-settings page and resizes it; the controller calls these self-scoped
|
||||
// endpoints; the AGENT enforces every bound FRESH per request (the UI's numbers are decoration) and
|
||||
// applies via the PVE API's SetConfig — a live cgroup apply, no reboot (Phase-0 proved it: maxmem
|
||||
// moves with the guest running, /proc/meminfo ripples via lxcfs). Memory only; cores stay observation.
|
||||
//
|
||||
// Ruled bounds (Viktor, 2026-07-17):
|
||||
// - min = minGuestMemoryMB (2048)
|
||||
// - max = host_total − hostReserveMB (2048 reserved for the host)
|
||||
// - shrink floor = max(minGuestMemoryMB, current_usage + shrinkUsageMarginMB) — a customer wanting
|
||||
// less must stop applications first (the refusal says so, in the controller's Hungarian).
|
||||
//
|
||||
// The floor gates SHRINK only; a grow is bounded by min/max alone.
|
||||
|
||||
const (
|
||||
// minGuestMemoryMB is the ruled floor for any guest allocation (a Felhom box needs headroom).
|
||||
minGuestMemoryMB int64 = 2048
|
||||
// hostReserveMB is held back from the host total so a resize can never starve the hypervisor.
|
||||
hostReserveMB int64 = 2048
|
||||
// shrinkUsageMarginMB is the safety gap kept above live usage on a SHRINK (the "never below
|
||||
// current usage" ruling, with headroom). One named constant — trivially re-ruled.
|
||||
shrinkUsageMarginMB int64 = 512
|
||||
// mib is one Proxmox "memory" unit (MiB) in bytes. PVE config `memory` is MiB; status/node
|
||||
// memory fields are bytes — convert at this boundary (the §8 units trap).
|
||||
mib int64 = 1 << 20
|
||||
)
|
||||
|
||||
// MemoryOps is the guest-RAM-resize Proxmox surface (v0.90.0). Satisfied by *proxmox.Client. Kept
|
||||
// separate from GuestAPI so adding it breaks no existing fake. Every method is invoked ONLY with the
|
||||
// token-resolved VMID (never a caller-supplied id).
|
||||
type MemoryOps interface {
|
||||
GuestStatus(ctx context.Context, vmid int) (proxmox.Guest, error)
|
||||
GuestConfig(ctx context.Context, vmid int) (proxmox.GuestConfig, error)
|
||||
NodeStatus(ctx context.Context) (proxmox.NodeStatus, error)
|
||||
SetConfig(ctx context.Context, vmid int, params map[string]string) (string, error)
|
||||
WaitTask(ctx context.Context, upid string, opts proxmox.WaitOptions) (proxmox.TaskStatus, error)
|
||||
}
|
||||
|
||||
// MemoryInfo is GET /guest/memory — every field in MB, computed agent-side (Scenario C). min/max/floor
|
||||
// are the CURRENT enforced bounds, so a stale UI re-renders honestly on every read/refusal.
|
||||
type MemoryInfo struct {
|
||||
VMID int `json:"vmid"`
|
||||
AllocatedMB int64 `json:"allocated_mb"`
|
||||
UsageMB int64 `json:"usage_mb"`
|
||||
HostTotalMB int64 `json:"host_total_mb"`
|
||||
MinMB int64 `json:"min_mb"`
|
||||
MaxMB int64 `json:"max_mb"`
|
||||
FloorMB int64 `json:"floor_mb"`
|
||||
Running bool `json:"running"`
|
||||
}
|
||||
|
||||
// memoryResizeRequest is the POST /guest/memory body.
|
||||
type memoryResizeRequest struct {
|
||||
VMID int `json:"vmid,omitempty"` // optional; if set must equal the token's guest (self-scope)
|
||||
MemoryMB int64 `json:"memory_mb"`
|
||||
}
|
||||
|
||||
// memoryRefusal is the data field of a 412 refusal: the machine code the controller maps to Hungarian,
|
||||
// plus the fresh bounds so the UI re-renders without a second round-trip.
|
||||
type memoryRefusal struct {
|
||||
Code string `json:"code"` // below_min | above_max | below_usage_floor
|
||||
AllocatedMB int64 `json:"allocated_mb"`
|
||||
UsageMB int64 `json:"usage_mb"`
|
||||
HostTotalMB int64 `json:"host_total_mb"`
|
||||
MinMB int64 `json:"min_mb"`
|
||||
MaxMB int64 `json:"max_mb"`
|
||||
FloorMB int64 `json:"floor_mb"`
|
||||
}
|
||||
|
||||
// memoryResizeResult is the success data field.
|
||||
type memoryResizeResult struct {
|
||||
VMID int `json:"vmid"`
|
||||
OldMB int64 `json:"old_mb"`
|
||||
NewMB int64 `json:"new_mb"`
|
||||
Unchanged bool `json:"unchanged"`
|
||||
}
|
||||
|
||||
// memoryBounds is one fresh snapshot of everything the validation needs.
|
||||
type memoryBounds struct {
|
||||
allocatedMB int64
|
||||
usageMB int64
|
||||
hostTotalMB int64
|
||||
minMB int64
|
||||
maxMB int64
|
||||
floorMB int64
|
||||
running bool
|
||||
}
|
||||
|
||||
func (b memoryBounds) refusal(code string) memoryRefusal {
|
||||
return memoryRefusal{
|
||||
Code: code, AllocatedMB: b.allocatedMB, UsageMB: b.usageMB, HostTotalMB: b.hostTotalMB,
|
||||
MinMB: b.minMB, MaxMB: b.maxMB, FloorMB: b.floorMB,
|
||||
}
|
||||
}
|
||||
|
||||
func (b memoryBounds) info(vmid int) MemoryInfo {
|
||||
return MemoryInfo{
|
||||
VMID: vmid, AllocatedMB: b.allocatedMB, UsageMB: b.usageMB, HostTotalMB: b.hostTotalMB,
|
||||
MinMB: b.minMB, MaxMB: b.maxMB, FloorMB: b.floorMB, Running: b.running,
|
||||
}
|
||||
}
|
||||
|
||||
// bytesToMBUp converts bytes → MB rounding UP (usage must never be under-reported for the floor).
|
||||
func bytesToMBUp(b int64) int64 {
|
||||
if b <= 0 {
|
||||
return 0
|
||||
}
|
||||
return (b + mib - 1) / mib
|
||||
}
|
||||
|
||||
// readMemoryBounds computes the enforced bounds from a FRESH read of guest config/status + host total.
|
||||
// Called by BOTH the GET and the POST so a stale UI can never smuggle an old max/floor.
|
||||
func (s *Server) readMemoryBounds(ctx context.Context, vmid int) (memoryBounds, error) {
|
||||
cfg, err := s.mem.GuestConfig(ctx, vmid)
|
||||
if err != nil {
|
||||
return memoryBounds{}, fmt.Errorf("guest config: %w", err)
|
||||
}
|
||||
st, err := s.mem.GuestStatus(ctx, vmid)
|
||||
if err != nil {
|
||||
return memoryBounds{}, fmt.Errorf("guest status: %w", err)
|
||||
}
|
||||
node, err := s.mem.NodeStatus(ctx)
|
||||
if err != nil {
|
||||
return memoryBounds{}, fmt.Errorf("node status: %w", err)
|
||||
}
|
||||
b := memoryBounds{
|
||||
allocatedMB: cfg.Memory, // PVE config memory is already MB
|
||||
usageMB: bytesToMBUp(st.Mem), // bytes → MB, rounded up
|
||||
hostTotalMB: node.Memory.Total / mib, // bytes → MB, floor (conservative for max)
|
||||
minMB: minGuestMemoryMB,
|
||||
running: st.Status == "running",
|
||||
}
|
||||
b.maxMB = b.hostTotalMB - hostReserveMB
|
||||
b.floorMB = b.usageMB + shrinkUsageMarginMB
|
||||
if b.floorMB < minGuestMemoryMB {
|
||||
b.floorMB = minGuestMemoryMB
|
||||
}
|
||||
return b, nil
|
||||
}
|
||||
|
||||
// handleGuestMemory serves GET /guest/memory — the current allocation, live usage, and the enforced
|
||||
// bounds, all agent-computed (Scenario C).
|
||||
func (s *Server) handleGuestMemory(w http.ResponseWriter, r *http.Request, vmid int) {
|
||||
if s.mem == nil {
|
||||
writeErr(w, http.StatusServiceUnavailable, "guest memory resize not configured on this host")
|
||||
return
|
||||
}
|
||||
b, err := s.readMemoryBounds(r.Context(), vmid)
|
||||
if err != nil {
|
||||
s.logger.Error("local-api: guest-memory read", "vmid", vmid, "err", err)
|
||||
writeErr(w, http.StatusBadGateway, "could not read guest memory: "+err.Error())
|
||||
return
|
||||
}
|
||||
writeOK(w, b.info(vmid))
|
||||
}
|
||||
|
||||
// handleGuestMemoryResize serves POST /guest/memory — validate FRESH against the ruled bounds (the UI's
|
||||
// numbers are decoration), then apply via SetConfig (live cgroup apply) and verify the new maxmem before
|
||||
// claiming success. Single-flight (one customer per host). SetConfig is NEVER called on a refusal path.
|
||||
func (s *Server) handleGuestMemoryResize(w http.ResponseWriter, r *http.Request, vmid int) {
|
||||
if s.mem == nil {
|
||||
writeErr(w, http.StatusServiceUnavailable, "guest memory resize not configured on this host")
|
||||
return
|
||||
}
|
||||
var req memoryResizeRequest
|
||||
if !decodeBody(w, r, &req) {
|
||||
return
|
||||
}
|
||||
if !s.scopedFromBody(w, req.VMID, vmid, r.URL.Path) {
|
||||
return
|
||||
}
|
||||
if req.MemoryMB <= 0 {
|
||||
writeErr(w, http.StatusBadRequest, "memory_mb must be a positive integer")
|
||||
return
|
||||
}
|
||||
|
||||
// Single-flight: one customer per host; last-write-wins at PVE is not a UX we want.
|
||||
s.memMu.Lock()
|
||||
defer s.memMu.Unlock()
|
||||
|
||||
b, err := s.readMemoryBounds(r.Context(), vmid)
|
||||
if err != nil {
|
||||
s.logger.Error("local-api: guest-memory resize precheck", "vmid", vmid, "err", err)
|
||||
writeErr(w, http.StatusBadGateway, "could not read guest memory: "+err.Error())
|
||||
return
|
||||
}
|
||||
target := req.MemoryMB
|
||||
|
||||
// No-op: target == current allocation → success, no SetConfig call.
|
||||
if target == b.allocatedMB {
|
||||
s.logger.Info("local-api: guest-memory resize no-op (unchanged)", "vmid", vmid, "memory_mb", target)
|
||||
writeOK(w, memoryResizeResult{VMID: vmid, OldMB: b.allocatedMB, NewMB: b.allocatedMB, Unchanged: true})
|
||||
return
|
||||
}
|
||||
|
||||
// Ruled refusals — SetConfig MUST NOT run on any of these.
|
||||
switch {
|
||||
case target < b.minMB:
|
||||
s.logger.Warn("local-api: guest-memory resize refused (below_min)", "vmid", vmid, "target_mb", target, "min_mb", b.minMB)
|
||||
writeStatus(w, http.StatusPreconditionFailed, false, b.refusal("below_min"),
|
||||
fmt.Sprintf("requested %d MB is below the minimum %d MB", target, b.minMB))
|
||||
return
|
||||
case target > b.maxMB:
|
||||
s.logger.Warn("local-api: guest-memory resize refused (above_max)", "vmid", vmid, "target_mb", target, "max_mb", b.maxMB)
|
||||
writeStatus(w, http.StatusPreconditionFailed, false, b.refusal("above_max"),
|
||||
fmt.Sprintf("requested %d MB exceeds the maximum %d MB (host reserve %d MB)", target, b.maxMB, hostReserveMB))
|
||||
return
|
||||
case target < b.allocatedMB && target < b.floorMB:
|
||||
// SHRINK below the usage floor — the customer must stop applications first.
|
||||
s.logger.Warn("local-api: guest-memory resize refused (below_usage_floor)",
|
||||
"vmid", vmid, "target_mb", target, "usage_mb", b.usageMB, "floor_mb", b.floorMB)
|
||||
writeStatus(w, http.StatusPreconditionFailed, false, b.refusal("below_usage_floor"),
|
||||
fmt.Sprintf("requested %d MB is too close to current usage %d MB (floor %d MB) — stop applications first", target, b.usageMB, b.floorMB))
|
||||
return
|
||||
}
|
||||
|
||||
// Apply. SetConfig may be synchronous (empty UPID) or return a task to wait on.
|
||||
upid, err := s.mem.SetConfig(r.Context(), vmid, map[string]string{"memory": fmt.Sprintf("%d", target)})
|
||||
if err != nil {
|
||||
s.logger.Error("local-api: guest-memory SetConfig", "vmid", vmid, "target_mb", target, "err", err)
|
||||
writeErr(w, http.StatusBadGateway, "memory resize failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
if upid != "" {
|
||||
if _, err := s.mem.WaitTask(r.Context(), upid, proxmox.WaitOptions{}); err != nil {
|
||||
s.logger.Error("local-api: guest-memory WaitTask", "vmid", vmid, "upid", upid, "err", err)
|
||||
writeErr(w, http.StatusBadGateway, "memory resize task failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
}
|
||||
|
||||
// Verify: re-read and confirm maxmem reflects the target before claiming success (never trust the
|
||||
// POST 200 — the config could have been rejected at task execution, or applied as pending).
|
||||
st, err := s.mem.GuestStatus(r.Context(), vmid)
|
||||
if err != nil {
|
||||
s.logger.Error("local-api: guest-memory post-apply status", "vmid", vmid, "err", err)
|
||||
writeErr(w, http.StatusBadGateway, "resize applied but verification read failed: "+err.Error())
|
||||
return
|
||||
}
|
||||
if st.MaxMem != target*mib {
|
||||
s.logger.Error("local-api: guest-memory resize NOT reflected after apply",
|
||||
"vmid", vmid, "target_mb", target, "observed_maxmem_bytes", st.MaxMem)
|
||||
writeErr(w, http.StatusBadGateway,
|
||||
fmt.Sprintf("resize did not take effect (guest still reports %d MB) — a reboot may be required", st.MaxMem/mib))
|
||||
return
|
||||
}
|
||||
s.logger.Info("local-api: guest-memory resized", "vmid", vmid, "old_mb", b.allocatedMB, "new_mb", target)
|
||||
writeOK(w, memoryResizeResult{VMID: vmid, OldMB: b.allocatedMB, NewMB: target})
|
||||
}
|
||||
@@ -0,0 +1,281 @@
|
||||
package localapi
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"net/http"
|
||||
"sync"
|
||||
"testing"
|
||||
|
||||
"gitea.dooplex.hu/admin/felhom-agent/internal/proxmox"
|
||||
)
|
||||
|
||||
// fakeMemory is a MemoryOps fake: it holds the guest's allocation/usage + host total, counts
|
||||
// SetConfig calls (so refusals can prove the non-effect), and — when applyReflect is set — makes a
|
||||
// SetConfig update the observed maxmem so the post-apply verify read passes.
|
||||
type fakeMemory struct {
|
||||
mu sync.Mutex
|
||||
allocMB int64
|
||||
usageBytes int64
|
||||
maxmemBytes int64
|
||||
hostTotalB int64
|
||||
status string
|
||||
setCalls int
|
||||
lastParams map[string]string
|
||||
setUPID string
|
||||
setErr error
|
||||
applyReflect bool
|
||||
}
|
||||
|
||||
func (f *fakeMemory) GuestConfig(_ context.Context, _ int) (proxmox.GuestConfig, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
return proxmox.GuestConfig{Memory: f.allocMB}, nil
|
||||
}
|
||||
func (f *fakeMemory) GuestStatus(_ context.Context, vmid int) (proxmox.Guest, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
return proxmox.Guest{VMID: vmid, Mem: f.usageBytes, MaxMem: f.maxmemBytes, Status: f.status}, nil
|
||||
}
|
||||
func (f *fakeMemory) NodeStatus(_ context.Context) (proxmox.NodeStatus, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
var ns proxmox.NodeStatus
|
||||
ns.Memory.Total = f.hostTotalB
|
||||
return ns, nil
|
||||
}
|
||||
func (f *fakeMemory) SetConfig(_ context.Context, _ int, params map[string]string) (string, error) {
|
||||
f.mu.Lock()
|
||||
defer f.mu.Unlock()
|
||||
f.setCalls++
|
||||
f.lastParams = params
|
||||
if f.setErr != nil {
|
||||
return "", f.setErr
|
||||
}
|
||||
if f.applyReflect {
|
||||
if mb, ok := params["memory"]; ok {
|
||||
var v int64
|
||||
for _, c := range mb {
|
||||
v = v*10 + int64(c-'0')
|
||||
}
|
||||
f.allocMB = v
|
||||
f.maxmemBytes = v * mib
|
||||
}
|
||||
}
|
||||
return f.setUPID, nil
|
||||
}
|
||||
func (f *fakeMemory) WaitTask(_ context.Context, _ string, _ proxmox.WaitOptions) (proxmox.TaskStatus, error) {
|
||||
return proxmox.TaskStatus{Status: "stopped", ExitStatus: "OK"}, nil
|
||||
}
|
||||
func (f *fakeMemory) calls() int { f.mu.Lock(); defer f.mu.Unlock(); return f.setCalls }
|
||||
|
||||
// memServer builds a valid server with the memory fake wired and token "A" → guest 8200.
|
||||
func memServer(t *testing.T, f *fakeMemory) *Server {
|
||||
t.Helper()
|
||||
s := newTestServerS(t, &fakeGuests{}, &fakeBackups{}, &fakeStore{}, nil)
|
||||
s.mem = f
|
||||
return s
|
||||
}
|
||||
|
||||
// stdFixture: allocated 8192 MB, usage 3000 MB, host_total 16384 MB, running.
|
||||
func stdFixture() *fakeMemory {
|
||||
return &fakeMemory{
|
||||
allocMB: 8192,
|
||||
usageBytes: 3000 * mib,
|
||||
maxmemBytes: 8192 * mib,
|
||||
hostTotalB: 16384 * mib,
|
||||
status: "running",
|
||||
applyReflect: true,
|
||||
}
|
||||
}
|
||||
|
||||
type memResp struct {
|
||||
OK bool `json:"ok"`
|
||||
Data struct {
|
||||
VMID int `json:"vmid"`
|
||||
AllocatedMB int64 `json:"allocated_mb"`
|
||||
UsageMB int64 `json:"usage_mb"`
|
||||
HostTotalMB int64 `json:"host_total_mb"`
|
||||
MinMB int64 `json:"min_mb"`
|
||||
MaxMB int64 `json:"max_mb"`
|
||||
FloorMB int64 `json:"floor_mb"`
|
||||
Running bool `json:"running"`
|
||||
Code string `json:"code"`
|
||||
OldMB int64 `json:"old_mb"`
|
||||
NewMB int64 `json:"new_mb"`
|
||||
Unchanged bool `json:"unchanged"`
|
||||
} `json:"data"`
|
||||
Error string `json:"error"`
|
||||
}
|
||||
|
||||
func decodeMem(t *testing.T, body []byte) memResp {
|
||||
t.Helper()
|
||||
var m memResp
|
||||
if err := json.Unmarshal(body, &m); err != nil {
|
||||
t.Fatalf("decode response %q: %v", body, err)
|
||||
}
|
||||
return m
|
||||
}
|
||||
|
||||
// Scenario C — GET /guest/memory: every field agent-computed, in MB.
|
||||
func TestGuestMemory_GET(t *testing.T) {
|
||||
f := stdFixture()
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "GET", "/guest/memory", "A", "")
|
||||
if w.Code != 200 {
|
||||
t.Fatalf("GET = %d (%s), want 200", w.Code, w.Body.String())
|
||||
}
|
||||
d := decodeMem(t, w.Body.Bytes()).Data
|
||||
if d.AllocatedMB != 8192 || d.UsageMB != 3000 || d.HostTotalMB != 16384 ||
|
||||
d.MinMB != 2048 || d.MaxMB != 14336 || d.FloorMB != 3512 || !d.Running {
|
||||
t.Errorf("GET fields wrong: %+v", d)
|
||||
}
|
||||
}
|
||||
|
||||
// Scenario A — grow + shrink happy paths: exactly one SetConfig, correct param, success.
|
||||
func TestGuestMemory_GrowAndShrink(t *testing.T) {
|
||||
t.Run("grow", func(t *testing.T) {
|
||||
f := stdFixture()
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", `{"memory_mb":12288}`)
|
||||
if w.Code != 200 {
|
||||
t.Fatalf("grow = %d (%s), want 200", w.Code, w.Body.String())
|
||||
}
|
||||
d := decodeMem(t, w.Body.Bytes()).Data
|
||||
if d.OldMB != 8192 || d.NewMB != 12288 {
|
||||
t.Errorf("grow result = %+v", d)
|
||||
}
|
||||
if f.calls() != 1 {
|
||||
t.Errorf("SetConfig calls = %d, want 1", f.calls())
|
||||
}
|
||||
if f.lastParams["memory"] != "12288" {
|
||||
t.Errorf("SetConfig param = %q, want 12288", f.lastParams["memory"])
|
||||
}
|
||||
})
|
||||
t.Run("shrink above floor", func(t *testing.T) {
|
||||
f := stdFixture() // floor = max(2048, 3000+512) = 3512
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", `{"memory_mb":4096}`)
|
||||
if w.Code != 200 {
|
||||
t.Fatalf("shrink = %d (%s), want 200 (4096 >= floor 3512)", w.Code, w.Body.String())
|
||||
}
|
||||
if f.calls() != 1 {
|
||||
t.Errorf("SetConfig calls = %d, want 1", f.calls())
|
||||
}
|
||||
})
|
||||
}
|
||||
|
||||
// Scenario B — the ruled refusals: 412 with the code, and SetConfig NEVER called.
|
||||
func TestGuestMemory_Refusals(t *testing.T) {
|
||||
cases := []struct {
|
||||
name, body, code string
|
||||
}{
|
||||
{"below_min", `{"memory_mb":1024}`, "below_min"},
|
||||
{"above_max", `{"memory_mb":15000}`, "above_max"},
|
||||
{"below_usage_floor", `{"memory_mb":3300}`, "below_usage_floor"},
|
||||
}
|
||||
for _, c := range cases {
|
||||
t.Run(c.name, func(t *testing.T) {
|
||||
f := stdFixture()
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", c.body)
|
||||
if w.Code != http.StatusPreconditionFailed {
|
||||
t.Fatalf("%s = %d (%s), want 412", c.name, w.Code, w.Body.String())
|
||||
}
|
||||
d := decodeMem(t, w.Body.Bytes()).Data
|
||||
if d.Code != c.code {
|
||||
t.Errorf("code = %q, want %q", d.Code, c.code)
|
||||
}
|
||||
if f.calls() != 0 {
|
||||
t.Errorf("SetConfig called %d times on a refusal — must be 0", f.calls())
|
||||
}
|
||||
// The refusal carries fresh bounds so the UI re-renders honestly.
|
||||
if d.MinMB != 2048 || d.MaxMB != 14336 || d.FloorMB != 3512 {
|
||||
t.Errorf("refusal bounds wrong: min=%d max=%d floor=%d", d.MinMB, d.MaxMB, d.FloorMB)
|
||||
}
|
||||
if c.code == "below_usage_floor" && d.UsageMB != 3000 {
|
||||
t.Errorf("below_usage_floor usage_mb = %d, want 3000", d.UsageMB)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// B4 — cross-guest body vmid → 403, SetConfig not called.
|
||||
func TestGuestMemory_CrossGuestRefused(t *testing.T) {
|
||||
f := stdFixture()
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", `{"vmid":9999,"memory_mb":10000}`)
|
||||
if w.Code != http.StatusForbidden {
|
||||
t.Fatalf("cross-guest = %d, want 403", w.Code)
|
||||
}
|
||||
if f.calls() != 0 {
|
||||
t.Errorf("SetConfig called on a cross-guest refusal (%d)", f.calls())
|
||||
}
|
||||
}
|
||||
|
||||
// B5 — bounds are re-read FRESH per request: raising usage between the GET and the POST makes a
|
||||
// previously-valid shrink target fall below the NEW floor (a stale UI can't smuggle an old floor).
|
||||
func TestGuestMemory_FreshBoundsPerRequest(t *testing.T) {
|
||||
f := stdFixture() // usage 3000 → floor 3512
|
||||
h := memServer(t, f).Handler()
|
||||
// GET sees floor 3512; target 3600 would be a valid shrink under it.
|
||||
if d := decodeMem(t, do(t, h, "GET", "/guest/memory", "A", "").Body.Bytes()).Data; d.FloorMB != 3512 {
|
||||
t.Fatalf("initial floor = %d, want 3512", d.FloorMB)
|
||||
}
|
||||
// Usage climbs to 3600 MB → floor becomes 4112. The POST must read this FRESH.
|
||||
f.mu.Lock()
|
||||
f.usageBytes = 3600 * mib
|
||||
f.mu.Unlock()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", `{"memory_mb":3700}`)
|
||||
if w.Code != http.StatusPreconditionFailed {
|
||||
t.Fatalf("post = %d (%s), want 412 (fresh floor 4112 > 3700)", w.Code, w.Body.String())
|
||||
}
|
||||
d := decodeMem(t, w.Body.Bytes()).Data
|
||||
if d.Code != "below_usage_floor" || d.FloorMB != 4112 {
|
||||
t.Errorf("fresh-bounds refusal = code %q floor %d, want below_usage_floor / 4112", d.Code, d.FloorMB)
|
||||
}
|
||||
if f.calls() != 0 {
|
||||
t.Errorf("SetConfig called (%d) despite fresh-floor refusal", f.calls())
|
||||
}
|
||||
}
|
||||
|
||||
// target == current allocation → success no-op, no SetConfig.
|
||||
func TestGuestMemory_UnchangedNoOp(t *testing.T) {
|
||||
f := stdFixture()
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", `{"memory_mb":8192}`)
|
||||
if w.Code != 200 {
|
||||
t.Fatalf("no-op = %d (%s), want 200", w.Code, w.Body.String())
|
||||
}
|
||||
d := decodeMem(t, w.Body.Bytes()).Data
|
||||
if !d.Unchanged || f.calls() != 0 {
|
||||
t.Errorf("no-op should not SetConfig: unchanged=%v calls=%d", d.Unchanged, f.calls())
|
||||
}
|
||||
}
|
||||
|
||||
// Verify-after-apply: SetConfig "succeeds" but the maxmem never reflects the target → 502, no false
|
||||
// success (a pending/reboot-required outcome is caught, never claimed as done).
|
||||
func TestGuestMemory_ApplyNotReflected(t *testing.T) {
|
||||
f := stdFixture()
|
||||
f.applyReflect = false // SetConfig returns ok but the guest keeps its old maxmem
|
||||
h := memServer(t, f).Handler()
|
||||
w := do(t, h, "POST", "/guest/memory", "A", `{"memory_mb":10000}`)
|
||||
if w.Code != http.StatusBadGateway {
|
||||
t.Fatalf("unreflected apply = %d (%s), want 502", w.Code, w.Body.String())
|
||||
}
|
||||
if f.calls() != 1 {
|
||||
t.Errorf("SetConfig calls = %d, want 1 (it was attempted)", f.calls())
|
||||
}
|
||||
}
|
||||
|
||||
// Not configured (nil Memory) → 503 on both routes.
|
||||
func TestGuestMemory_NotConfigured(t *testing.T) {
|
||||
s := newTestServerS(t, &fakeGuests{}, &fakeBackups{}, &fakeStore{}, nil) // mem stays nil
|
||||
h := s.Handler()
|
||||
if w := do(t, h, "GET", "/guest/memory", "A", ""); w.Code != http.StatusServiceUnavailable {
|
||||
t.Errorf("GET nil-mem = %d, want 503", w.Code)
|
||||
}
|
||||
if w := do(t, h, "POST", "/guest/memory", "A", `{"memory_mb":9000}`); w.Code != http.StatusServiceUnavailable {
|
||||
t.Errorf("POST nil-mem = %d, want 503", w.Code)
|
||||
}
|
||||
}
|
||||
@@ -91,6 +91,9 @@ type Options struct {
|
||||
// GuestAttach binds an enrolled user-data drive's felhom-data namespace into the guest (slice 10
|
||||
// P2, Model A). OPTIONAL — when nil, POST /disks/guest-attach reports "not configured".
|
||||
GuestAttach GuestAttacher
|
||||
// Memory is the guest-RAM-resize Proxmox surface (v0.90.0, R-24). OPTIONAL — when nil, the
|
||||
// /guest/memory endpoints report "not configured". Satisfied by *proxmox.Client.
|
||||
Memory MemoryOps
|
||||
// NetStorage is the privileged network-mount (NAS) surface (Part A1). OPTIONAL — when nil, the
|
||||
// /netstorage endpoints report "not configured". Satisfied by *storage.SudoHostOps.
|
||||
NetStorage NetworkStorageOps
|
||||
@@ -188,6 +191,8 @@ type Server struct {
|
||||
diskGate StorageGate // slice 8C (optional)
|
||||
guestList GuestLister // slice 8C (optional)
|
||||
guestAttach GuestAttacher // slice 10 P2 (optional)
|
||||
mem MemoryOps // v0.90.0 R-24 guest RAM resize (optional)
|
||||
memMu sync.Mutex // single-flight around a resize apply (one customer per host)
|
||||
netStorage NetworkStorageOps // Part A1: NAS network mounts (optional)
|
||||
netMountRoot string // the user-data namespace root for the network-mount role gate
|
||||
smbCredsDir string // where SMB creds files are written (out-of-band, 0600)
|
||||
@@ -300,6 +305,7 @@ func NewServer(o Options) (*Server, error) {
|
||||
diskGate: o.DiskGate,
|
||||
guestList: o.Guests2,
|
||||
guestAttach: o.GuestAttach,
|
||||
mem: o.Memory,
|
||||
netStorage: o.NetStorage,
|
||||
netMountRoot: storage.NetworkMountRoot,
|
||||
smbCredsDir: o.SmbCredsDir,
|
||||
@@ -365,6 +371,10 @@ func (s *Server) Handler() http.Handler {
|
||||
mux.HandleFunc("POST /disks/guest-attach", s.withGuest(s.handleDiskGuestAttach))
|
||||
// Guest reboot (slice 10 P2 activation): user-triggered restart to activate pending drive binds.
|
||||
mux.HandleFunc("POST /guest/reboot", s.withGuest(s.handleGuestReboot))
|
||||
// Guest RAM resize (v0.90.0, R-24): read current allocation + bounds, and apply a bounded resize
|
||||
// (live cgroup apply, no reboot). Self-scoped; the agent enforces every bound fresh per request.
|
||||
mux.HandleFunc("GET /guest/memory", s.withGuest(s.handleGuestMemory))
|
||||
mux.HandleFunc("POST /guest/memory", s.withGuest(s.handleGuestMemoryResize))
|
||||
|
||||
// Network storage (NAS) — Part A1: mount/list/remove a bulk-media NAS share host-side (automount
|
||||
// idle-unmount; +100000 uid recipe). A distinct class from a drive — no enroll/eject/wipe.
|
||||
|
||||
Reference in New Issue
Block a user