Budget Kubernetes watches by namespace and resource kind #74
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Problem and evidence
ProviderRuntime::start_watchincrates/agent/src/provider_runtime.rs:555+stores watches by instance and kind and caps them at 16 per instance and 32 runtime-wide. Kubernetes watches are scoped by API kind and namespace, so one generic kind key does not itself describe all namespace subscriptions or how they consume that bounded budget.Recommendation
When PLAN step 11 is scheduled, define watch identity, admission and ownership for namespace/kind subscriptions under the existing 16/32 limits. Include cancellation, resync and recovery in the quota model; do not raise caps without measured memory and workload evidence.
Payoff and estimate
Keeps namespace-scoped watch recovery bounded as the Kubernetes provider grows. Estimate: 1–2 engineering days after the adapter shape is fixed, including real cluster/RBAC tests across multiple namespaces.
Priority: Later (PLAN step 11 is deferred).
2026-10-04 owner decisions: Matches the approved namespace-scoped Kubernetes slice and its explicit exclusion of create/scale, cluster admin and port-forward. No Kubernetes implementation starts before its deferred step.
Report: arch-review report
Source: arch-review 2026-10-04