Struct EphemeralPool 

pub struct EphemeralPool {
    pub metadata: ObjectMeta,
    pub spec: PoolSpec,
    pub status: Option<PoolStatus>,
}

Auto-generated derived type for PoolSpec via CustomResource

Fields

metadata: ObjectMeta

spec: PoolSpec

status: Option<PoolStatus>

Implementations

impl EphemeralPool

pub fn new(name: &str, spec: PoolSpec) -> Self

Spec based constructor for derived custom resource

impl EphemeralPool

pub fn name_or_empty(&self) -> &str

Borrow-form metadata-projection primitive on the metadata.name axis of EphemeralPool: returns the K8s object name slice with the missing-name corner collapsed to the load-bearing empty-string sentinel — the ONE-liner collapse of the paired self.metadata.name.as_deref().unwrap_or("") incantation every pool-side consumer restated by hand pre-lift.

Pre-lift the .metadata.name.as_deref().unwrap_or("") chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-pool-reconciler, both keyed by the pool’s own name slot:

• router::pool_name — the tie-break comparator inside best_match; a deterministic lexicographic-min-name arbiter across two pool candidates whose specificity scores tie.
• controller_allocation::reconcile_inner — the HashMap< pool-name, Vec<PoolMember>> lookup closure fed into decide_allocation_reconcile; keys the “which pool members back this allocation candidate?” projection at every allocation-reconcile pass.

Both sites walked the SAME .as_deref().unwrap_or("") chain and both wanted the &str form the primitive returns — as a borrow suitable for lexicographic str::cmp in the tie-break AND for the HashMap<String, _>::get(&str) lookup. Post-lift each caller reaches for pool.name_or_empty() and the produced slice feeds the same downstream comparator / lookup unchanged.

The empty-string fallback is the SAME sentinel the sibling borrow-form primitive crate::crd::Process::uid_or_empty returns AND the SAME sentinel the owned-form sibling crate::crd::Process::owned_name_or_empty returns on the metadata.name axis of the sister CRD — the three primitives partition the (borrow-form × owned-form) × (uid × name) corner of the metadata-slot family on identical fallback semantics (empty string means “the slot is unset”), so a consumer that switches between the CRD surfaces based on downstream keying requirements never sees a different missing-slot spelling as a side effect.

Return-form axis: &str mirrors the borrow-first discipline of the peer metadata primitives on Process (crate::crd::Process::namespace_or_default, crate::crd::Process::name_or_placeholder, crate::crd::Process::uid_or_empty). The one missing-slot corner the chain swallowed pre-lift (missing metadata.name) collapses to the empty-string sentinel so str::is_empty / HashMap::get on an unnamed pool behaves identically to what the pre-lift .as_deref().unwrap_or("") chain produced.

A future normalization step (a name-canonicalization pass, a case-fold key builder, a per-cluster prefix stripper for cross-cluster pool-name aliasing) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at pool_name / reconcile_inner.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.name.as_deref().unwrap_or("") chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-name corner + the empty-string sentinel byte-shape + the borrow-form &str lifetime + the byte-identical parity with the pre-lift chain + the fallback- value coherence with Process::uid_or_empty / Process::owned_name_or_empty on the metadata-slot × empty- sentinel axis, so a regression that drifted any surface at tests::name_or_empty_* here rather than as silent operator- facing skew between the router tie-break and the allocation member-lookup on the SAME pool candidate).

pub fn owned_name_or_empty(&self) -> String

Owned-form metadata-projection primitive on the metadata.name axis of EphemeralPool: returns an owned String copy of the K8s object name with the missing-name corner collapsed to the load- bearing empty-string sentinel — the ONE-liner collapse of the paired self.metadata.name.clone().unwrap_or_default() incantation every pool-side consumer restated by hand pre-lift.

Pre-lift the .metadata.name.clone().unwrap_or_default() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-pool-reconciler, both keyed by the pool’s own name slot in an owned String context:

• controller_allocation::reconcile_inner — the HashMap<String, Vec<PoolMember>> key seed inside a pools.iter().map(|p| ...).collect() fanout; the map key is the owned String form because the produced HashMap<String, _> outlives the pool-list borrow that generated it and the downstream pool_members.get(pool.name_or_empty()) closure consumes it as &str.
• allocation_decide::AllocationConvergenceCtx::observe — the AllocationRef::name slot seed stamped on the matched-pool handle; the struct literal is AllocationRef { name: String, namespace: String } and the produced value is threaded through the Decision::decide transition rule downstream.

Both sites walked the SAME .clone().unwrap_or_default() chain and both wanted the String form the primitive returns — as the owned key of a HashMap<String, _> and as the String slot of an AllocationRef struct literal. Post-lift each callsite reads pool.owned_name_or_empty() and the produced value feeds the same downstream key / struct-literal slot unchanged.

The empty-string fallback is the SAME sentinel the sibling borrow-form primitive Self::name_or_empty returns AND the SAME sentinel the sibling owned-form primitive crate::crd::Process::owned_name_or_empty returns on the metadata.name axis of the sister CRD — the three primitives partition the (borrow-form × owned-form) corner of the metadata- name family across BOTH tatara-process CRDs on identical missing- slot semantics (empty string means “the slot is unset”), so a consumer that switches between the CRD surfaces based on downstream ownership requirements never sees a different missing-slot spelling as a side effect.

Peer to Self::name_or_empty on the (return-form × ownership) axis pair — closes the corner the pool-side family previously left open:

• borrow + empty sentinel → Self::name_or_empty (router tie- break comparator, HashMap<String, _>::get(&str) lookup — consumers whose downstream keys by &str and allocates nothing);
• owned + empty sentinel → this method (HashMap-key seed in an outliving-borrow context, AllocationRef::name struct- literal slot — consumers whose downstream requires the owned String form because the produced value outlives the source- pool borrow).

A future normalization step (a name-canonicalization pass, a case-fold key builder, a per-cluster prefix stripper for cross- cluster pool-name aliasing) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at reconcile_inner / AllocationConvergenceCtx::observe.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.name.clone().unwrap_or_default() chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-name corner + the empty-string sentinel byte-shape + the owned-form String return type + the byte-identical parity with the pre-lift chain + the fallback- value coherence with Self::name_or_empty + crate::crd::Process::owned_name_or_empty on the metadata- slot × empty-sentinel axis, so a regression that drifted any surface at tests::owned_name_or_empty_* here rather than as silent operator-facing skew between the pool-members lookup key and the AllocationRef seed on the SAME pool candidate).

pub fn is_being_deleted(&self) -> bool

Copy-form metadata-projection primitive on the deletion-tombstone axis of EphemeralPool: returns true iff the K8s API server has stamped a metadata.deletionTimestamp on this pool (the moment the object entered the “being deleted” corner of its lifecycle, after which further mutating writes are refused and finalizers are drained before the object is actually removed) — the ONE-liner collapse of the paired self.metadata.deletion_timestamp.is_some() incantation every pool-side consumer restated by hand pre-lift.

Pre-lift the .metadata.deletion_timestamp.is_some() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-pool-reconciler, both projecting the SAME tombstone-presence predicate on an EphemeralPool value:

• pool_decide::decide_pool_reconcile — the pure decision function’s deletion-preempt gate that forces [PoolDecision::Drain] as soon as the API server stamps the tombstone, before the (desired vs actual) supply-arithmetic branches get a chance to run. Wired at the very top of the decision so a draining pool never spawns / reaps / expires through the normal replenishment arithmetic while the deletion is in flight.
• controller_pool::pool_phase_from_members — the observed- phase composer’s tombstone-first arm that returns PoolPhase::Draining regardless of the supply / demand arithmetic that would otherwise pick Ready / Scaling / Degraded. Keeps the reported phase honest during the finalizer drain so operators reading kubectl get ephemeralpools see the tombstone-present state as Draining, not as a stale Ready.

Both sites walked the SAME .metadata.deletion_timestamp .is_some() chain and both wanted the bool form the primitive returns — the decide_pool_reconcile site to gate the → Drain short-circuit and the pool_phase_from_members site to gate the → Draining short-circuit. Post-lift each callsite reads pool.is_being_deleted() and the produced bool feeds the same downstream short-circuit unchanged.

Sibling to crate::crd::Process::is_being_deleted on the deletion-tombstone axis of the sister CRD — the two primitives now partition the tombstone-presence probe across BOTH tatara-process CRDs on identical missing-slot semantics (present timestamp means “the API server has begun deletion”), so an operator or reconciler that switches between the CRD surfaces never sees a different tombstone-detection spelling as a side effect.

Return-form axis: bool matches the copy-form discipline of the sibling crate::crd::Process::is_being_deleted and of the pool-side crate::phase::ProcessPhase::is_alive + Self::name_or_empty-family primitives — the underlying slot is a wire-format Option<Time> that carries only presence information at this axis (the RFC-3339 timestamp payload itself is not what the two consumers read; both only probe presence to detect the tombstone-stamped state). Returning the raw Option<&Time> would push the .is_some() probe back to every callsite, restating the pre-lift chain one link shorter without collapsing the primitive.

Peer to Self::name_or_empty and Self::owned_name_or_empty on the metadata-projection axis for EphemeralPool; this method opens the presence-probe corner for the tombstone slot. Future metadata-presence projections on the pool CRD (an is_being_finalized projection on metadata.finalizers.is_empty()’s negation, a has_owner projection on metadata.owner_references.is_empty()’s negation) land as peer methods on this same axis.

A future normalization step (a per-tombstone staleness gate that returns false for a tombstone older than the reconciler’s grace-period budget, a canonicalization pass that treats a tombstone from a paused controller as absent, a cross-cluster tombstone-observation clock skew guard) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at decide_pool_reconcile / pool_phase_from_members.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.deletion_timestamp.is_some() chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-tombstone corner + the present- tombstone corner + the copy-form bool return + the byte- identical parity with the pre-lift .is_some() chain + the cross-CRD coherence with crate::crd::Process::is_being_deleted on the tombstone axis, so a regression that drifted any surface at tests::is_being_deleted_* rather than as silent operator- facing skew between the pool-reconciler’s → Drain decision and the observed-phase composer’s → Draining report on the SAME EphemeralPool within one reconcile pass).

pub fn owned_namespace_or_empty(&self) -> String

Owned-form metadata-projection primitive on the metadata.namespace axis of EphemeralPool: returns an owned String copy of the K8s namespace with the missing-namespace corner collapsed to the load- bearing empty-string sentinel — the ONE-liner collapse of the paired self.metadata.namespace.clone().unwrap_or_default() incantation every pool-side consumer restated by hand pre-lift.

Pre-lift the .metadata.namespace.clone().unwrap_or_default() chain was hand-authored at TWO sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold, both stamping the AllocationRef { namespace: String, .. } slot inside an owned-String context:

• tatara-pool-reconciler::allocation_decide::AllocationConvergenceCtx ::observe — the matched-pool seed’s AllocationRef.namespace slot, right beside the peer Self::owned_name_or_empty call that owns the paired name half. This is the exact site the pre-existing peer-primitive doc-comment forecast ("a future run may lift owned_namespace_or_empty as the sibling axis peer").
• crate::pool::tests::allocation_ref_new_composes_with_owned_name_or_empty_pool_projection — the composition pin that seeded an AllocationRef from the same paired-primitive-half construction the production consumer in allocation_decide::observe performs. Post-lift the pin composes two peer primitives (owned_name_or_empty + owned_namespace_or_empty) rather than one primitive plus the pre-lift chain, sharpening it from a mixed-form composition check into a paired-primitive-family composition check.

Both sites walked the SAME .clone().unwrap_or_default() chain and both wanted the String form the primitive returns — as the String slot of an AllocationRef struct literal built through crate::pool::AllocationRef::new. Post-lift each callsite reads pool.owned_namespace_or_empty() and the produced value feeds the same downstream AllocationRef slot unchanged.

The empty-string fallback is the SAME sentinel the sibling owned- form primitive Self::owned_name_or_empty returns on the metadata.name axis of the same CRD — the two primitives now partition the (owned String × metadata.<slot>) corner of the pool CRD’s metadata family across BOTH object-coordinate slots on identical missing-slot semantics (empty string means “the slot is unset”), so the crate::pool::AllocationRef::new composer sees a coherent owned-empty pair regardless of which slot is absent on the source pool. Coherent with the workspace- wide owned-empty sentinel that the peer primitives crate::crd::Process::uid_or_empty, crate::crd::Process::owned_name_or_empty, Self::name_or_empty, and Self::owned_name_or_empty already share on the metadata-slot × empty-sentinel axis.

Peer to Self::owned_name_or_empty on the (metadata.name × metadata.namespace) axis of the owned-form projection family — closes the corner the pool-side family previously left open:

• owned + name + empty sentinel → Self::owned_name_or_empty (AllocationRef.name seed, HashMap<String, _> key seed);
• owned + namespace + empty sentinel → this method (AllocationRef.namespace seed — the paired half the same AllocationRef::new(name, namespace) constructor consumes);
• copy + deletion + tombstone probe → Self::is_being_deleted (the presence-probe corner of the same metadata axis, already opened).

A future normalization step (a namespace-canonicalization pass, a case-fold key builder, a per-cluster prefix stripper, or the canonical-namespace default lift that would substitute crate::crd::Process::DEFAULT_NAMESPACE on the missing-slot corner rather than the empty-string sentinel) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at AllocationConvergenceCtx::observe / the composition pin.

The empty-string fallback (rather than crate::crd::Process::DEFAULT_NAMESPACE) is DELIBERATELY pinned: the sole downstream consumer (AllocationConvergenceCtx::observe’s matched-pool seed) feeds the produced value into AllocationRef.namespace, which is then matched byte-identically against spec.pool_ref.namespace at [crate::pool::allocation_decide::resolve_pool]-style comparators. A silent substitution of "default" at this primitive would alias every namespace-absent pool to the "default" bucket at the matcher, hiding the missing-slot corner from an operator who explicitly authored an allocation against a namespace- unset pool. The load-bearing empty-string sentinel keeps the pre-lift .clone().unwrap_or_default() shape verbatim so the downstream matcher’s byte-comparison stays honest.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.namespace.clone().unwrap_or_default() chain recurred at two hand-authored sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-namespace corner + the empty-string sentinel byte-shape + the owned-form String return type + the byte-identical parity with the pre-lift chain + the fallback- value coherence with Self::owned_name_or_empty on the paired-slot axis, so a regression that drifted any surface at tests::owned_namespace_or_empty_* rather than as silent operator-facing skew between the paired name / namespace halves of the SAME AllocationRef seed).

pub fn has_name(&self, candidate: &str) -> bool

Copy-form metadata-projection primitive on the metadata.name axis of EphemeralPool in its presence-and-equal corner: returns true iff the K8s object name slot is BOTH Some(_) AND byte-identical to the supplied candidate — the ONE-liner collapse of the paired self.metadata.name.as_deref() == Some(candidate) incantation every pool-side lookup consumer restated by hand pre-lift.

Pre-lift the .metadata.name.as_deref() == Some(<candidate>) chain was hand-authored at TWO production sites past the ★★ PRIME-DIRECTIVE ≥ 2 duplication threshold in tatara-pool-reconciler, both keyed by the EphemeralPool’s own name slot inside a candidate_pools.iter().find(|p| ...) closure that resolves a pool from an AllocationRef.name half:

• allocation_decide::resolve_pool — the explicit-pool_ref half of the pool-resolution ladder, one of two conjuncts in the (name == X && namespace == Y) byte-comparison against AllocationSpec::pool_ref. Pairs with the sibling namespace comparison (a future run may lift has_namespace as the paired-axis peer once a second namespace-probe site opens).
• controller_allocation::reconcile_inner — the TTL-inheritance fallback path’s pool-lookup by AllocationDecision::Bind::pool .name, feeding the matched pool’s spec.template.ttl into the just-bound member Process’s lifetime overlay.

Both sites walked the SAME .as_deref() == Some(<x>.as_str()) chain against a &str candidate held by an AllocationRef or a similar owned-name handle, and both wanted the bool form the primitive returns — the transition rule’s discriminant on either the find(|p| p.has_name(&pool_ref.name)) closure (which either matches ONE candidate pool or none) or the TTL-inheritance closure’s short-circuit through .map(...).unwrap_or_else(...). Post-lift each callsite reads p.has_name(&candidate) and the produced bool feeds the same downstream find / map closure unchanged.

Distinct in semantics from the sibling primitive Self::name_or_empty on the SAME metadata.name axis: the _or_empty family folds the missing-slot corner to the load- bearing empty-string sentinel (so None and Some("") both project to ""), whereas this primitive keeps None distinct from Some("") at the == operator — a None slot returns false even when the candidate is the empty string. That discipline is load-bearing at both consumer sites: pre-lift they compared Option<&str> against Some(<candidate>), so a substitution through Self::name_or_empty would silently promote a namespace-absent pool with a "" candidate into a spurious match at the find closure, aliasing every unnamed pool to the same lookup bucket at the resolver. Preserving the None ⇒ false corner keeps the resolver’s byte-comparison honest.

Peer to the sibling substrate primitives already opened on the pool-side (metadata.name × return-form) axis:

• borrow-form + empty sentinel → Self::name_or_empty (&str projection with a "" fallback for missing / explicitly-empty name slots; router tie-break comparator);
• owned-form + empty sentinel → Self::owned_name_or_empty (String projection with a "" fallback; AllocationRef.name seed);
• presence-and-equal probe → this method (bool projection with None-preserving semantics; pool-lookup closure discriminant).

A future normalization step (a name-canonicalization pass, a case-fold key builder, a per-cluster prefix stripper for cross- cluster pool-name aliasing, or a canonical-namespace default lift) lands at ONE substrate method here and both downstream consumers pick up the upgrade mechanically — no per-callsite hand-edit at resolve_pool / controller_allocation ::reconcile_inner.

Theory anchor: THEORY.md §VI.1 (generation over composition — the .metadata.name.as_deref() == Some(<candidate>) chain recurred at two hand-authored sites past the ★★ PRIME- DIRECTIVE ≥ 2 duplication trigger, and is lifted to ONE owner here). THEORY.md §II.1 invariant 5 (composition preserves proofs — the pins bind the missing-slot corner (None ⇒ false, even against a "" candidate) + the populated-slot equal corner + the populated-slot unequal corner + the byte-identical parity with the pre-lift .as_deref() == Some (<candidate>) chain + the disjoint semantics vs. the _or_empty sibling family, so a regression that drifted any surface at tests::has_name_* here rather than as silent operator-facing skew between the two find closures the primitive owns).

Trait Implementations

impl Clone for EphemeralPool

fn clone(&self) -> EphemeralPool

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl CustomResourceExt for EphemeralPool

fn crd() -> CustomResourceDefinition

Helper to generate the CRD including the JsonSchema

fn crd_name() -> &'static str

Helper to return the name of this CustomResourceDefinition in kubernetes.

fn api_resource() -> ApiResource

Helper to generate the api information type for use with the dynamic Api

fn shortnames() -> &'static [&'static str]

Shortnames of this resource type.

impl Debug for EphemeralPool

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl<'de> Deserialize<'de> for EphemeralPool

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl HasSpec for EphemeralPool

type Spec = PoolSpec

The type of the spec of this resource

fn spec(&self) -> &PoolSpec

Returns a reference to the spec of the object

fn spec_mut(&mut self) -> &mut PoolSpec

Returns a mutable reference to the spec of the object

impl HasStatus for EphemeralPool

type Status = PoolStatus

The type of the status object

fn status(&self) -> Option<&PoolStatus>

Returns an optional reference to the status of the object

fn status_mut(&mut self) -> &mut Option<PoolStatus>

Returns an optional mutable reference to the status of the object

impl JsonSchema for EphemeralPool

fn schema_name() -> String

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn is_referenceable() -> bool

Whether JSON Schemas generated for this type should be re-used where possible using the $ref keyword.

impl Resource for EphemeralPool

type DynamicType = ()

Type information for types that do not know their resource information at compile time.

type Scope = NamespaceResourceScope

Type information for the api scope of the resource when known at compile time

fn group(_: &()) -> Cow<'_, str>

Returns group of this object

fn kind(_: &()) -> Cow<'_, str>

Returns kind of this object

fn version(_: &()) -> Cow<'_, str>

Returns version of this object

fn api_version(_: &()) -> Cow<'_, str>

Returns apiVersion of this object

fn plural(_: &()) -> Cow<'_, str>

Returns the plural name of the kind

fn meta(&self) -> &ObjectMeta

Metadata that all persisted resources must have

fn meta_mut(&mut self) -> &mut ObjectMeta

Metadata that all persisted resources must have

fn url_path(dt: &Self::DynamicType, namespace: Option<&str>) -> String

Creates a url path for http requests for this resource

fn object_ref(&self, dt: &Self::DynamicType) -> ObjectReference

Generates an object reference for the resource

fn controller_owner_ref(&self, dt: &Self::DynamicType) -> Option<OwnerReference>

Generates a controller owner reference pointing to this resource

fn owner_ref(&self, dt: &Self::DynamicType) -> Option<OwnerReference>

Generates an owner reference pointing to this resource

impl Serialize for EphemeralPool

fn serialize<S: Serializer>(&self, ser: S) -> Result<S::Ok, S::Error>

Serialize this value into the given Serde serializer.