Skip to content

Commit edc484b

Browse files
upglerabbah
upgle
and
rabbah
authored
[Proposal] POEM: Providing action limits for each namespace (#5236)
* Add POEM (Providing action limits for each namespace) * Apply suggestions from code review Co-authored-by: rodric rabbah <[email protected]> * Update POEM-3-action-limit-for-namespace.md Co-authored-by: rodric rabbah <[email protected]>
1 parent 0912c73 commit edc484b

File tree

1 file changed

+283
-0
lines changed

1 file changed

+283
-0
lines changed

‎proposals/POEM-3-action-limit-for-namespace.md

Lines changed: 283 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,283 @@
1+
<!--
2+
#
3+
# Licensed to the Apache Software Foundation (ASF) under one or more
4+
# contributor license agreements. See the NOTICE file distributed with
5+
# this work for additional information regarding copyright ownership.
6+
# The ASF licenses this file to You under the Apache License, Version 2.0
7+
# (the "License"); you may not use this file except in compliance with
8+
# the License. You may obtain a copy of the License at
9+
#
10+
# http://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# Unless required by applicable law or agreed to in writing, software
13+
# distributed under the License is distributed on an "AS IS" BASIS,
14+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
# See the License for the specific language governing permissions and
16+
# limitations under the License.
17+
#
18+
-->
19+
20+
# Title
21+
Providing action limits for each namespace
22+
23+
## Status
24+
* Current state: In-progress
25+
* Author(s): @upgle
26+
27+
## Summary and Motivation
28+
29+
This POEM proposes a new feature that allows administrators to set action limits (memory, timeout, log, and concurrency) for each namespace.
30+
31+
Sometimes some users want to make an action with more memory and longer duration. But, OpenWhisk only has a system limit for action shared by all namespaces.
32+
There is no way to adjust the action limit for a few users, and changing the action limit setting will affect all users.
33+
34+
In some private environments, you can operate OpenWhisk more flexibly by providing different action limits.
35+
(For example, providing high memory only to some users.)
36+
37+
```
38+
256M 512M
39+
40+
│ namespace default limit │
41+
▼ ▼
42+
┌──────────┬──────────────────────────────────┬────────────┬────────────────────────┐
43+
│ │┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼┼│----------► │ │
44+
└──────────┴──────────────────────────────────┴────────────┴────────────────────────┘
45+
▲ ▲ ▲
46+
│ system limit │ namespace limit │ system limit
47+
48+
128M 1024M 2048M
49+
```
50+
51+
## Proposed changes
52+
53+
### 3 types of action limits
54+
55+
There was only a system limit shared by all namespaces, but two more concepts for namespace limits are added.
56+
57+
- (1) system limit: It can never be exceeded under any circumstances.
58+
- (2) namespace default limit: It can be used if a limit has not been set for a namespace.
59+
- (3) namespace limit: It can be set by a system administrator for a namespace and cannot exceed the range of the system limit.
60+
61+
### Limit configs for namespace
62+
63+
- The maxParameterSize, maxPayloadSize and truncationSize values are treated as `ByteSize` string. (e.g. 1 MB, 512 KB...)
64+
65+
The following settings are new:
66+
67+
config key | Type | description
68+
---------------------- | ---------------------------- | ---------------
69+
minActionMemory | integer (unit: MB) | minimum action memory size for namespace
70+
maxActionMemory | integer (unit: MB) | maximum action memory size for namespace
71+
minActionLogs | integer (unit: MB) | minimum activation log size for namespace
72+
maxActionLogs | integer (unit: MB) | maximum activation log size for namespace
73+
minActionTimeout | integer (unit: milliseconds) | minimum action time limit for namespace
74+
maxActionTimeout | integer (unit: milliseconds) | maximum action time limit for namespace
75+
minActionConcurrency | integer | minimum action concurrency limit for namespace
76+
maxActionConcurrency | integer | maximum action concurrency limit for namespace
77+
maxParameterSize | string (format: ByteSize) | maximum parameter size for namespace
78+
maxPayloadSize | string (format: ByteSize) | maximum payload size for namespace
79+
truncationSize | string (format: ByteSize) | activation truncation size for namespace
80+
81+
82+
### Limit document for CouchDB
83+
84+
You can set namespace limits with `{namespace}/limits` document just like any other existing settings (e.g., invocationsPerMinute, concurrentInvocations).
85+
86+
```json
87+
{
88+
"concurrentInvocations": 100,
89+
"invocationsPerMinute": 100,
90+
"firesPerMinute": 100,
91+
"maxActionMemory": 1024,
92+
"minActionMemory": 128,
93+
"maxActionConcurrency": 400,
94+
"minActionConcurrency": 1,
95+
"maxActionLogs": 128,
96+
"minActionLogs": 0,
97+
"maxParameterSize": "1048576 B"
98+
}
99+
```
100+
101+
#### Applying namespace limit
102+
- Because there is no administrator API, you must modify the DB directly or use the wskadmin tool.
103+
- There is plan to provide the feauture to change namespace limits in wskadmin.
104+
105+
### Namespace Limit API
106+
107+
User can get the applied action limits of the namespace by the namespace limit API.
108+
If the namespace's action limit is not set, the default namespace limit value will be returned.
109+
110+
> GET /api/v1/namespaces/_/limits
111+
112+
```json
113+
{
114+
"concurrentInvocations": 30,
115+
"firesPerMinute": 60,
116+
"invocationsPerMinute": 60,
117+
"maxActionConcurrency": 500,
118+
"maxActionLogs": 0,
119+
"maxActionMemory": 512,
120+
"maxActionTimeout": 300000,
121+
"maxParameterSize": "1048576 B",
122+
"minActionConcurrency": 1,
123+
"minActionLogs": 0,
124+
"minActionMemory": 128,
125+
"minActionTimeout": 100
126+
}
127+
```
128+
129+
### System API (URI path: /)
130+
131+
A namespace default limit information is additionally provided separately from the previously provided system limit information.
132+
133+
- default_max_action_duration
134+
- default_max_action_logs
135+
- default_max_action_memory
136+
- default_min_action_duration
137+
- default_min_action_logs
138+
- default_min_action_memory
139+
140+
#### Preview
141+
142+
> GET /
143+
144+
```json
145+
{
146+
"api_paths": [
147+
"/api/v1"
148+
],
149+
"description": "OpenWhisk",
150+
"limits" : {
151+
"actions_per_minute": 60,
152+
"concurrent_actions": 30,
153+
"default_max_action_duration": 300000,
154+
"default_max_action_logs": 0,
155+
"default_max_action_memory": 536870912,
156+
"default_min_action_duration": 100,
157+
"default_min_action_logs": 0,
158+
"default_min_action_memory": 134217728,
159+
"max_action_duration": 300000,
160+
"max_action_logs": 0,
161+
"max_action_memory": 536870912,
162+
"min_action_duration": 100,
163+
"min_action_logs": 0,
164+
"min_action_memory": 134217728,
165+
"sequence_length": 50,
166+
"triggers_per_minute": 60
167+
}
168+
}
169+
```
170+
171+
### Backward compatibility
172+
173+
For backward compatibility, if there is no namespace default limit setting, it is replaced with a system limit.
174+
175+
As the namespace default limit is the same as the system limit, so the administrator cannot set the namespace limit, and the user can create actions with resources (memory, logs, timeout...) up to the system limit as before.
176+
177+
178+
### Namespace limit validation
179+
180+
Previously, system limits were validated when deserializing the `ActionLimits` object from the user request.
181+
182+
However, at the time of deserialization of the user requests, the namespace's action limit cannot be known and the limit value cannot be included in an error message, so the validation must be performed after deserialization.
183+
Therefore, the code to perform this validation has been added to the controller, scheduler, and invoker.
184+
185+
#### 1. Validate action limits when the action is created in the controller
186+
187+
When an action is created in the controller, make sure that the action limits do not exceed the system limits and namespace limits.
188+
189+
If the namespace limits or system limits are exceeded, the namespace limit value must be returned as an error message in the response body.
190+
191+
```
192+
┌───────────────┐
193+
│ │
194+
│ AuthStore │
195+
│ │
196+
└───────┬───────┘
197+
│
198+
┌───────┴───────┐
199+
│ │
200+
│ Identity │ UserLimits
201+
│ │ (maxActionMemory = 512M)
202+
Create action ┌───────────────────┐ └───────────────┘
203+
(memory = 1024M) │ │ ▲
204+
──────────────────► │ │ │
205+
│ Controller ├────────────────┘
206+
◄────────X───────── │ │ Validate namespace limit
207+
Reject request │ │
208+
(1024M > 512M) └───────────────────┘
209+
```
210+
211+
212+
#### 2. Validate action limits when the action is executed in the invoker
213+
214+
When the action is executed, the invoker must checks whether the action limit exceeds the system limit and namespace limits.
215+
If the limit of the action to be executed exceeds the limit, an application error with `Messages.actionLimitExceeded` message is returned and invocation is aborted.
216+
217+
```scala
218+
case _: ActionLimitsException =>
219+
ActivationResponse.applicationError(Messages.actionLimitExceeded)
220+
```
221+
222+
```
223+
┌───────────────┐
224+
│ │
225+
│ Identity │ UserLimits
226+
│ │ (maxActionMemory = 512M)
227+
└───────────────┘
228+
▲
229+
│ Validate namespace limit
230+
│
231+
Invoke action ┌───────────────────┐ Activation ┌────┴──────────────┐
232+
(memory = 1024M) │ │ Message │ │
233+
──────────────────► │ │ ─────────────────► │ │
234+
│ Controller │ │ Invoker │
235+
◄────────X───────── │ │ ◄────────X──────── │ │
236+
Reject request │ │ Reject │ │
237+
└───────────────────┘ Invocation └───────────────────┘
238+
(1024M > 512M)
239+
```
240+
241+
#### 3. Validate action limits when the action is executed in the invoker with the scheduler
242+
243+
The invoker that works with the scheduler should check namespace limits when creating containers and handling activations.
244+
245+
- When creating a container, if the requested resource of the action exceeds the namespace limit, creation is rejected and the queue is removed.
246+
- when processing an activation message, if the action exceeds the namespace limit, the activation is rejected.
247+
248+
249+
```
250+
┌───────────────┐
251+
│ │
252+
│ Identity │ UserLimits
253+
│ │ (maxActionMemory = 512M)
254+
└───────────────┘
255+
▲
256+
Invoker │
257+
┌─────────────────────────┼─┐
258+
┌─────────────┐ ContainerCreation │ │ │
259+
│ │ Message │ ┌────────────────────┐ │ │
260+
│ │ ───────────────────────┼─►│ ContainerMessage │ │ │
261+
│ │ │ │ Consumer ├─┤ │ Validate namespace limit
262+
│ │ ◄───────────X──────────┼─ └────────────────────┘ │ │
263+
│ Scheduler │ Reject creating │ │ │
264+
│ │ container │ ┌────────────────────┐ │ │
265+
│ │ │ │ FunctionPulling │ │ │
266+
│ │ ◄──────────────────────┼──┤ ContainerProxy ├─┘ │
267+
│ │ Fetch activation │ └──────────────┬─────┘ │
268+
└─────────────┘ │ │ │
269+
└─────────────────┼─────────┘
270+
Kafka │
271+
┌───────────────┐ │
272+
├───────────────┤ │
273+
│ Completed0 │ ◄─────────X─────────┘
274+
├───────────────┤ Activation Response
275+
└───────────────┘ (Reject 1024>512M)
276+
```
277+
278+
279+
280+
### Handling invalid namespace limits
281+
282+
Because there is no admin API to handle namespace limits, the CouchDB document may have namespace limit values that exceed the system limits.
283+
But, If there is a namespace limit that exceeds the system limit, the namespace limit is lowered to the system limit.

0 commit comments

Comments
 (0)