feat: support max allowed spec from Nacos (#1291)

Author: zhangjaycee

rock/config.py

@@ -751,11 +751,15 @@ async def update(self):
             runtime_overrides = nacos_result["runtime"]
             if "instance_registry_mirrors" in runtime_overrides:
                 self.runtime.instance_registry_mirrors = list(runtime_overrides["instance_registry_mirrors"] or [])
+            max_allowed_spec = runtime_overrides.get("max_allowed_spec")
+            if isinstance(max_allowed_spec, dict):
+                _merge_dataclass(self.runtime.max_allowed_spec, max_allowed_spec)
 
         logger.info(
             f"Updated config from Nacos: sandbox_config={self.sandbox_config}, proxy_service={self.proxy_service}"
             f", image_registry_mirrors={self.image_registry_mirrors}"
             f", image_mirror_lookup_allowlist={self.image_mirror_lookup_allowlist}"
             f", instance_registry_mirrors={self.runtime.instance_registry_mirrors}"
+            f", max_allowed_spec={self.runtime.max_allowed_spec}"
             f", lifecycle={self.lifecycle}"
         )

rock/sandbox/sandbox_manager.py

@@ -142,9 +142,11 @@ async def start_async(
         self, config: DeploymentConfig, user_info: UserInfo = {}, cluster_info: ClusterInfo = {}
     ) -> SandboxStartResponse:
         await self._check_sandbox_exists_in_redis(config)
-        self.validate_sandbox_spec(self.rock_config.runtime, config)
         with StageTimer("startup_timing", f"[{config.image}] Init config", logger):
             docker_deployment_config: DockerDeploymentConfig = await self.deployment_manager.init_config(config)
+        # init_config refreshes the cached Nacos settings; validate only after
+        # that refresh so a changed max_allowed_spec applies to this request.
+        self.validate_sandbox_spec(self.rock_config.runtime, config)
 
         sandbox_id = docker_deployment_config.container_name
         if self.rock_config.runtime.use_standard_spec_only:

tests/unit/sandbox/test_sandbox_transitions.py

@@ -410,6 +410,24 @@ async def capture_create(sandbox_id, sandbox_info, timeout_info=None, deployment
 
 
 class TestManagerStart:
+    @pytest.mark.asyncio
+    async def test_refreshes_nacos_config_before_validating_spec(self, mgr_start, mock_docker_config):
+        call_order = []
+
+        async def init_config(config):
+            call_order.append("refresh")
+            return mock_docker_config
+
+        def validate(runtime_config, config):
+            call_order.append("validate")
+
+        mgr_start.deployment_manager.init_config.side_effect = init_config
+        mgr_start.validate_sandbox_spec.side_effect = validate
+
+        await mgr_start.start_async(MagicMock(image="python:3.11"))
+
+        assert call_order[:2] == ["refresh", "validate"]
+
     @pytest.mark.asyncio
     async def test_start_registers_effective_policy_before_operator_submit(
         self, mgr_start, mock_meta_store, mock_operator

tests/unit/test_config.py

@@ -495,6 +495,69 @@ async def test_nacos_update_without_runtime_key_preserves_instance_mirrors():
     assert rock_config.runtime.instance_registry_mirrors == ["keep.example.com/ns"]
 
 
+# ===== Nacos hot-reload for max_allowed_spec =====
+
+
+@pytest.mark.asyncio
+async def test_nacos_update_loads_max_allowed_spec():
+    rock_config = RockConfig()
+    rock_config.nacos_provider = MagicMock()
+    rock_config.nacos_provider.get_config = AsyncMock(
+        return_value={
+            "runtime": {
+                "max_allowed_spec": {
+                    "cpus": 32,
+                    "memory": "128g",
+                    "disk": "512g",
+                },
+            },
+        }
+    )
+
+    await rock_config.update()
+
+    assert rock_config.runtime.max_allowed_spec.cpus == 32
+    assert rock_config.runtime.max_allowed_spec.memory == "128g"
+    assert rock_config.runtime.max_allowed_spec.disk == "512g"
+
+
+@pytest.mark.asyncio
+async def test_nacos_max_allowed_spec_partial_update_preserves_yaml_values():
+    rock_config = RockConfig(
+        runtime=RuntimeConfig(
+            max_allowed_spec={
+                "cpus": 8,
+                "memory": "32g",
+                "disk": "128g",
+            }
+        )
+    )
+    rock_config.nacos_provider = MagicMock()
+    rock_config.nacos_provider.get_config = AsyncMock(
+        return_value={"runtime": {"max_allowed_spec": {"cpus": 12}}}
+    )
+
+    await rock_config.update()
+
+    assert rock_config.runtime.max_allowed_spec.cpus == 12
+    assert rock_config.runtime.max_allowed_spec.memory == "32g"
+    assert rock_config.runtime.max_allowed_spec.disk == "128g"
+
+
+@pytest.mark.asyncio
+async def test_nacos_without_max_allowed_spec_preserves_existing_limit():
+    rock_config = RockConfig()
+    rock_config.runtime.max_allowed_spec.cpus = 10
+    rock_config.nacos_provider = MagicMock()
+    rock_config.nacos_provider.get_config = AsyncMock(
+        return_value={"runtime": {"instance_registry_mirrors": ["reg.example.com/ns"]}}
+    )
+
+    await rock_config.update()
+
+    assert rock_config.runtime.max_allowed_spec.cpus == 10
+
+
 # ===== _resolve_k8s_template_includes =====