Skip to main content

shape

workload_spec::validate

Function shape 

Source 
pub fn shape(spec: &WorkloadSpec) -> Result<Vec<ShapeWarning>, ShapeError>
Expand description

Run shape validation — sync, no I/O.

Returns Ok(warnings) when all hard constraints pass; the Vec is empty for a clean spec. Returns Err on the first hard constraint violation. Callers that only need hard errors can discard the Ok value with .map(|_| ()).

Hard constraints checked:

  • name, expose.mesh.identity: DNS-label format, ≤ 63 chars.
  • expose.operator.tailscale_tag: "tag:<dns-label>", ≤ 63 chars.
  • replicas: 0–100.
  • image.tag: non-empty when digest is None.
  • volumes[*].source = Bind: only allowed when tier = "infra".
  • expose.public.port: must appear in expose.mesh.ports.
  • secrets[*].target: file paths must be absolute; env-var names must match ^[A-Z_][A-Z0-9_]*$.

Soft checks (produce warnings, not errors):

  • Unknown tier value.
  • RestartPolicy::Never without annotations["yah.forge"] = "true".
  • healthcheck.initial_delay < stop_policy.grace_period * 2.