ce7cb702218693d08ea6d83464d2457c9250027c
This commit is contained in:
commit
34c5f8963c
1 changed files with 145336 additions and 0 deletions
141
docs/spec/tier-s/Runtime.tla
Normal file
141
docs/spec/tier-s/Runtime.tla
Normal file
|
|
@ -0,0 +1,141 @@
|
|||
---- MODULE Runtime ----
|
||||
EXTENDS Naturals, FiniteSets
|
||||
|
||||
\* Incumbent-owner projection of e063bc9 run.go/parameters.yaml, after successful setup and claim.
|
||||
\* Probe/endpoint convergence is asynchronous; shutdown here is graceful, unlike Lease.tla.
|
||||
CONSTANTS Fixed, PublishUnready, Scenario
|
||||
ASSUME Fixed \in BOOLEAN /\ PublishUnready \in BOOLEAN /\ Scenario \in {"health", "ports", "proxy", "outage"}
|
||||
|
||||
Heads == {0, 1}
|
||||
None == 2
|
||||
VARIABLES stage, daemon, configured, label, sas, sample, route, flag,
|
||||
observedHealthy, reported, podReady, endpoint, proxy,
|
||||
ports, appliedPorts, portRestart, lost, reachable
|
||||
vars == <<stage, daemon, configured, label, sas, sample, route, flag,
|
||||
observedHealthy, reported, podReady, endpoint, proxy,
|
||||
ports, appliedPorts, portRestart, lost, reachable>>
|
||||
|
||||
TypeOK ==
|
||||
/\ stage \in {"Load", "Scan", "Route", "Report", "Idle", "Stop"}
|
||||
/\ sas \subseteq Heads /\ sample \subseteq Heads
|
||||
/\ route \in Heads \cup {None}
|
||||
/\ ports \in 0..1 /\ appliedPorts \in 0..1
|
||||
/\ \A value \in {daemon, configured, label, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, portRestart, lost, reachable} : value \in BOOLEAN
|
||||
|
||||
Init ==
|
||||
/\ stage = "Load" /\ daemon = FALSE /\ configured = FALSE /\ label = FALSE
|
||||
/\ sas = {} /\ sample = {} /\ route = None /\ flag = FALSE
|
||||
/\ observedHealthy = FALSE /\ reported = FALSE
|
||||
/\ podReady = FALSE /\ endpoint = FALSE /\ proxy = TRUE
|
||||
/\ ports = 0 /\ appliedPorts = 0 /\ portRestart = FALSE /\ lost = FALSE /\ reachable = TRUE
|
||||
|
||||
Load ==
|
||||
/\ stage = "Load"
|
||||
/\ daemon' = TRUE /\ configured' = TRUE /\ label' = TRUE
|
||||
/\ stage' = "Scan" /\ appliedPorts' = ports /\ flag' = FALSE
|
||||
/\ UNCHANGED <<sas, sample, route, observedHealthy, reported, podReady,
|
||||
endpoint, proxy, ports, portRestart, lost, reachable>>
|
||||
|
||||
Scan ==
|
||||
/\ stage = "Scan" /\ daemon
|
||||
/\ sample' = sas /\ stage' = "Route"
|
||||
/\ UNCHANGED <<daemon, configured, label, sas, route, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, ports, appliedPorts, portRestart, lost, reachable>>
|
||||
|
||||
Route ==
|
||||
/\ stage = "Route"
|
||||
/\ route' = IF sample = {} THEN route ELSE IF 0 \in sample THEN 0 ELSE 1
|
||||
/\ stage' = "Report"
|
||||
/\ UNCHANGED <<daemon, configured, label, sas, sample, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, ports, appliedPorts, portRestart, lost, reachable>>
|
||||
|
||||
Report ==
|
||||
/\ stage = "Report"
|
||||
/\ flag' = IF Fixed THEN sample /= {} ELSE TRUE
|
||||
/\ observedHealthy' = (sample /= {} /\ route \in sample)
|
||||
/\ reported' = TRUE /\ stage' = "Idle"
|
||||
/\ UNCHANGED <<daemon, configured, label, sas, sample, route, podReady,
|
||||
endpoint, proxy, ports, appliedPorts, portRestart, lost, reachable>>
|
||||
|
||||
Poll ==
|
||||
/\ stage = "Idle" /\ ports = appliedPorts
|
||||
/\ stage' = "Scan"
|
||||
/\ UNCHANGED <<daemon, configured, label, sas, sample, route, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, ports, appliedPorts, portRestart, lost, reachable>>
|
||||
|
||||
ChangePorts ==
|
||||
/\ Scenario = "ports" /\ ports = 0 /\ stage = "Idle" /\ daemon
|
||||
/\ sas /= {} /\ route \in sas
|
||||
/\ ports' = 1
|
||||
/\ UNCHANGED <<stage, daemon, configured, label, sas, sample, route, flag,
|
||||
observedHealthy, reported, podReady, endpoint, proxy, appliedPorts,
|
||||
portRestart, lost, reachable>>
|
||||
|
||||
Reload ==
|
||||
/\ stage = "Idle" /\ ports /= appliedPorts
|
||||
/\ stage' = IF Fixed THEN "Scan" ELSE "Stop"
|
||||
/\ appliedPorts' = IF Fixed THEN ports ELSE appliedPorts
|
||||
/\ UNCHANGED <<daemon, configured, label, sas, sample, route, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, ports, portRestart, lost, reachable>>
|
||||
|
||||
Stop ==
|
||||
/\ stage = "Stop"
|
||||
/\ daemon' = FALSE /\ sas' = {} /\ flag' = FALSE /\ stage' = "Load"
|
||||
/\ portRestart' = (portRestart \/ (daemon /\ ports /= appliedPorts))
|
||||
/\ UNCHANGED <<configured, label, sample, route, observedHealthy, reported,
|
||||
podReady, endpoint, proxy, ports, appliedPorts, lost, reachable>>
|
||||
|
||||
Probe ==
|
||||
LET desired == configured /\ flag /\ (Fixed \/ proxy)
|
||||
IN /\ podReady /= desired /\ podReady' = desired
|
||||
/\ UNCHANGED <<stage, daemon, configured, label, sas, sample, route, flag,
|
||||
observedHealthy, reported, endpoint, proxy, ports, appliedPorts,
|
||||
portRestart, lost, reachable>>
|
||||
|
||||
\* Publishing the active endpoint before serving readiness breaks the initial IKE dependency cycle.
|
||||
Realize ==
|
||||
LET desired == label /\ (PublishUnready \/ podReady)
|
||||
IN /\ endpoint /= desired /\ endpoint' = desired
|
||||
/\ UNCHANGED <<stage, daemon, configured, label, sas, sample, route, flag,
|
||||
observedHealthy, reported, podReady, proxy, ports, appliedPorts,
|
||||
portRestart, lost, reachable>>
|
||||
|
||||
Negotiate ==
|
||||
/\ daemon /\ configured /\ endpoint /\ reachable /\ sas /= Heads
|
||||
/\ sas' \in SUBSET Heads /\ sas \subseteq sas' /\ sas' /= sas
|
||||
/\ UNCHANGED <<stage, daemon, configured, label, sample, route, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, ports, appliedPorts, portRestart, lost, reachable>>
|
||||
|
||||
LosePeers ==
|
||||
/\ ~lost /\ sas = Heads
|
||||
/\ IF Scenario = "outage" THEN sas' = {} ELSE sas' \in (SUBSET Heads) \ {Heads}
|
||||
/\ lost' = TRUE
|
||||
/\ reachable' = (Scenario /= "outage")
|
||||
/\ UNCHANGED <<stage, daemon, configured, label, sample, route, flag, observedHealthy,
|
||||
reported, podReady, endpoint, proxy, ports, appliedPorts, portRestart>>
|
||||
|
||||
ProxyFails ==
|
||||
/\ Scenario = "proxy" /\ proxy /\ podReady /\ endpoint
|
||||
/\ sas /= {} /\ route \in sas
|
||||
/\ proxy' = FALSE
|
||||
/\ UNCHANGED <<stage, daemon, configured, label, sas, sample, route, flag,
|
||||
observedHealthy, reported, podReady, endpoint, ports, appliedPorts,
|
||||
portRestart, lost, reachable>>
|
||||
|
||||
Next == Load \/ Scan \/ Route \/ Report \/ Poll \/ ChangePorts \/ Reload \/ Stop
|
||||
\/ Probe \/ Realize \/ Negotiate \/ LosePeers \/ ProxyFails
|
||||
|
||||
Spec == Init /\ [][Next]_vars
|
||||
/\ WF_vars(Load) /\ WF_vars(Scan) /\ WF_vars(Route) /\ WF_vars(Report)
|
||||
/\ WF_vars(Poll) /\ WF_vars(Reload) /\ WF_vars(Stop)
|
||||
/\ WF_vars(Probe) /\ WF_vars(Realize) /\ WF_vars(Negotiate)
|
||||
/\ SF_vars(ChangePorts) /\ SF_vars(ProxyFails) /\ SF_vars(LosePeers)
|
||||
|
||||
HealthyObservation == reported => (~flag \/ observedHealthy)
|
||||
PortContinuity == ~portRestart
|
||||
TransportRecovery == <>[]endpoint
|
||||
Usable == daemon /\ endpoint /\ sas /= {} /\ route \in sas /\ ports = appliedPorts
|
||||
ServingRecovery == (<>[]reachable) => <>[]Usable
|
||||
LossReported == (<>[]~reachable) => <>[](~flag /\ ~podReady)
|
||||
====
|
||||
Loading…
Reference in a new issue