Struct MoverSpec 

pub struct MoverSpec {
    pub resources: Option<ResourceRequirements>,
    pub cache: Option<CacheDefaults>,
    pub security_context: Option<SecurityContext>,
    pub pod_security_context: Option<PodSecurityContext>,
    pub privileged_mode: Option<bool>,
    pub inherit_security_context_from: Option<InheritSecurityContextFrom>,
    pub ttl_seconds_after_finished: Option<i64>,
}

Per-recipe mover overrides (resources, cache, security context).

Fields

resources: Option<ResourceRequirements>

Resource requests/limits for the mover container.

cache: Option<CacheDefaults>

Override the repository’s CacheDefaults for this recipe’s movers.

security_context: Option<SecurityContext>

Container security context for the mover; merged field-wise over the hardened base, moverDefaults, and any inherited context — this is the highest layer, so every field set here wins. Combines with inheritSecurityContextFrom: fields you set override the workload’s, fields you omit are inherited, and this context stands in alone when inheritance cannot resolve a pod.

pod_security_context: Option<PodSecurityContext>

Pod security context for the mover (notably fsGroup for group-writable restore volumes). Same layering as securityContext: highest layer, merged field-wise, and combinable with inheritSecurityContextFrom.

privileged_mode: Option<bool>

Opt-in, namespace-gated privileged mode. Never changes the UID. When the mover runs as root (runAsUser: 0), adds the capabilities the operation needs on top of drop: [ALL]: DAC_OVERRIDE for a backup (read files owned by any uid/gid); CHOWN, DAC_OVERRIDE, FOWNER, FSETID for a restore (reproduce original ownership). Grants nothing for maintenance, or when the mover does not run as root (capabilities are inert for non-root); set runAsUser: 0 yourself.

inherit_security_context_from: Option<InheritSecurityContextFrom>

Copy the UID/GID security context from a live workload rather than hard-coding it.

Requires the workload to pin runAsUser (container or pod level): a UID that comes from the container image’s USER line is invisible in the pod spec and cannot be inherited — the mover would silently run as its own image’s UID instead.

May be combined with securityContext/podSecurityContext, which override it field-wise and act as the fallback when no workload pod can be resolved.

ttl_seconds_after_finished: Option<i64>

Per-recipe override of Job.spec.ttlSecondsAfterFinished so finished Jobs self-GC.

Implementations

impl MoverSpec

pub fn requires_privilege(&self) -> bool

Whether this mover requests elevated privileges that the workload namespace must explicitly opt into (ADR §4.11/§G16). True when privilegedMode is set, or the securityContext runs as root / privileged / with escalation / with added Linux capabilities.

The rationale is the same as VolSync’s privileged-movers model: the controller mints a mover ServiceAccount in the workload namespace, and a tenant with access there could reuse it to run pods at the mover’s privilege. Granting an elevated mover is therefore a per-namespace admin decision, gated by a namespace annotation rather than allowed implicitly. Pure + exhaustive so the definition of “privileged” lives in one tested place.

pub fn privileged_mode_warning(&self, op: MoverOperation) -> Option<String>

Admission-time warning when privilegedMode: true would certainly grant nothing: this spec pins a non-zero runAsUser (capabilities are inert for non-root, and privilegedMode never picks a UID).

Judged on hardened ⊂ self only. A spec with no runAsUser stays silent: the repository’s moverDefaults may pin runAsUser: 0 and is invisible here, so warning would be a false positive. The controller’s PrivilegedModeInert Event, which sees the merged context, reports that case. An inheritSecurityContextFrom identity resolves at reconcile time, so it stays silent too.

pub fn merge_over(&self, base: Option<&MoverSpec>) -> MoverSpec

Overlay self — the HIGHER layer — onto base, field by field, producing one MoverSpec that stands in for both. This is what lets an invocation carry its own mover overrides on top of a shared, GitOps-managed recipe: Snapshot.spec.mover merged over SnapshotPolicy.spec.mover (#464).

The merge delegates to the SAME primitives the repository-layer merge uses, so a per-run override can never resolve differently from a per-recipe one:

• securityContext/podSecurityContext go through merge_context_pair as one (container, pod) layer pair — field-wise per dimension plus identity promotion, so a policy’s container-level runAsUser can never shadow a snapshot’s pod-level one. That merge is associative, so folding these two layers here and then handing the result to resolve_mover is identical to a flat hardened ⊂ moverDefaults ⊂ inherited ⊂ policy ⊂ snapshot merge.
• resources via merge_resources_opt (per-key requests/limits).
• cache via CacheDefaults::merge (per-field).
• privilegedMode, ttlSecondsAfterFinished and inheritSecurityContextFrom are whole-value knobs with no inner structure to merge, so the higher layer’s value wins outright and None falls through to base.

base: None is the identity: the result is self unchanged. Because the layer order is fixed by this signature, a caller cannot accidentally invert it.

Trait Implementations

impl Clone for MoverSpec

fn clone(&self) -> MoverSpec

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MoverSpec

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for MoverSpec

fn default() -> MoverSpec

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for MoverSpec

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl JsonSchema for MoverSpec

fn schema_name() -> Cow<'static, str>

The name of the generated JSON Schema.

fn schema_id() -> Cow<'static, str>

Returns a string that uniquely identifies the schema produced by this type.

fn json_schema(generator: &mut SchemaGenerator) -> Schema

Generates a JSON Schema for this type.

fn inline_schema() -> bool

Whether JSON Schemas generated for this type should be included directly in parent schemas, rather than being re-used where possible using the $ref keyword.

impl PartialEq for MoverSpec

fn eq(&self, other: &MoverSpec) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for MoverSpec

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for MoverSpec