jschoubben
588aa424e2
The builder says what it built and the catalogue decides whether that was an upgrade. Only the control plane knows which machines run the thing, so it is the one that acts — and what it does is a choice somebody recorded, not a behaviour compiled in: record that they are behind, or send it, one machine at a time or together. Recording is the absence of an action rather than a second path: a machine not running what the mesh would send it is already something the mesh reports. Defaulted to recording. A mesh that rolls out everything it builds the moment it builds it is reasonable to want and a bad thing to arrive by default — the first module to inherit it would be the control plane, upgrading itself out from under the push applying it.
27 lines
1.5 KiB
SQL
27 lines
1.5 KiB
SQL
-- What the mesh should do when the catalogue says a module has been upgraded.
|
|
--
|
|
-- novox/hq ADR 0072. The builder announces a build, the catalogue decides whether that is an
|
|
-- upgrade, and the control plane is the only one of the three that knows which machines are
|
|
-- running the thing. So it is the one that acts -- and what it does has to be a decision somebody
|
|
-- made, not a behaviour compiled in.
|
|
--
|
|
-- Two separate questions, deliberately not one:
|
|
--
|
|
-- whether -- roll the new version out, or record that the machine is behind and stop there.
|
|
-- how -- one machine at a time, or all of them together.
|
|
--
|
|
-- They are separate because the safe answer to the first is not the safe answer to the second: a
|
|
-- mesh may well want every upgrade applied automatically and still never want its only two
|
|
-- machines restarted in the same breath.
|
|
--
|
|
-- Defaulted to recording rather than rolling out, and per module rather than mesh-wide. A mesh
|
|
-- that upgrades everything it builds the moment it builds it is a reasonable thing to want and a
|
|
-- terrible thing to arrive by default -- the first module to inherit it would be the control plane
|
|
-- itself, upgrading itself out from under the push that was applying it.
|
|
alter table module add column upgrade text not null default 'record'
|
|
check (upgrade in ('record', 'roll-out'));
|
|
|
|
-- Only meaningful when upgrade is 'roll-out'. Kept anyway when it is not, so turning roll-out on
|
|
-- does not silently also decide this.
|
|
alter table module add column upgrade_together boolean not null default false;
|