mirror of
https://github.com/mudler/LocalAI.git
synced 2026-07-30 18:09:05 -04:00
* fix(distributed): stop the probe reaper from orphaning busy backends
The reconciler's liveness probe is a 1s gRPC HealthCheck, and a single
failed probe deleted the model's node_models row. A backend that is
merely busy cannot answer it: single-threaded Python backends (video and
avatar generation) block for minutes inside one request, so the reaper
was deleting registry rows for backends that were alive and mid-request.
The model then vanished from the nodes page while it was still
generating, and because the row was gone the in-flight decrement had
nothing to decrement ("DecrementInFlight: no matching row or already
zero"). Every subsequent request re-routed and re-staged the full model
from scratch.
Two guards:
- Replicas with in-flight requests are excluded in SQL. A row that is
actively serving is proof of life, and the running request is
exactly what stops the backend from answering the probe.
- Idle replicas must miss three CONSECUTIVE probes before removal, so
a transient blip cannot orphan a live replica. A successful probe
resets the streak.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]
* fix(distributed): drop the local model stub when its last replica goes
In distributed mode every routed model leaves an in-process stub in the
frontend's ModelLoader, and DistributedModelStore.Range reports local
stubs UNION the registry rows. Every registry removal path deletes only
the DB row, so the stub outlived the replica and the model was reported
as loaded forever.
That is the "loaded on the home page, absent from every node" ghost:
/system reads the union and still sees the stub, while /api/nodes/models
reads the registry and correctly sees nothing. It never self-healed,
and both frontend replicas showed it independently.
The replica-removed chokepoint could not fix this as it stood, because
it held a SINGLE hook that the prefix cache already owned, and it was
registered only when the prefix cache was enabled. Registering a second
listener would have silently displaced the first.
- Turn replicaRemovedHook into a list (AddReplicaRemovedHook), so
independent subsystems can each register without displacing others.
- Add NewLocalStubInvalidator, which drops the local stub once no
healthy replica of the model remains anywhere in the cluster, and
wire it unconditionally in startup.
The stub is kept while another node still serves the model: the
frontend is right to consider it loaded, and each request re-routes
through SmartRouter to pick a live replica anyway.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]
* fix(distributed): stop staging checksum sidecars back to workers
The file transfer server writes a "<file>.sha256" sidecar next to every
file it accepts. The sender walked the model directory with no filter,
so it staged those sidecars too, and the receiver duly wrote a sidecar
for each sidecar. Every staging pass multiplied the tree:
config.json -> config.json.sha256 -> config.json.sha256.sha256 -> ...
One LongCat snapshot had grown to 498 files, 466 of them chained, up to
29 levels deep, and the staged file count climbed on every pass. This
inflates each transfer and grows disk without bound on both ends.
Skip hash sidecars in stageDirectory, and mirror the skip in
countStageableFiles so the progress bar still reaches 100%. The check is
"a sidecar sitting next to a real file" rather than a blanket suffix
ban, so a model that genuinely ships a .sha256 payload with no
corresponding base file is still transferred.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]
* fix(distributed): classify the liveness probe instead of gating on in_flight
The previous commit excluded replicas with in-flight requests from the probe
reaper. That was the wrong guard, and could invert the bug it fixed.
in_flight has no decrement guarantee: track() balances its increment with a
defer, but a frontend killed mid-request never runs it, and the load-time
reservation is released only when the first inference completes. Nothing
resets a leaked counter. Gating the reaper on it therefore meant a leaked
counter would shield a genuinely dead replica from ever being reaped.
Nor was patience alone a fix: three misses at the default interval is ~90s of
silence, while the generation that triggered this blocks for 15+ minutes.
The real conflation was in the probe itself. A gRPC HealthCheck against the
backend's serving port measures "is it idle enough to answer", not "does the
process exist", and probeLoadedModels discarded the error that tells them
apart. Because the gRPC client is lazy, the status code is decisive:
- DeadlineExceeded: transport fine, nothing serviced the RPC. Busy.
- Unavailable: nothing is listening. Gone.
ModelProber now returns a ProbeOutcome, and only ProbeUnreachable counts
toward the reap threshold. ProbeBusy clears the streak: it is evidence of
life. A blackholed network reads as busy too, deliberately, since whole-node
failure is the health monitor's job.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]
* feat(distributed): reconcile replicas against worker-reported processes
Probing a backend's own serving port cannot distinguish "busy" from "gone"
without inferring it from an error code. The worker can answer directly: it
spawned the process, holds the handle, and its reply is not blocked by
whatever that backend is doing.
Adds a models.running request-reply subject. The worker answers out of its
in-memory process table, reporting each live process as (modelID,
replicaIndex, address) — the supervisor's process keys are `modelID#replica`,
which is isomorphic to a NodeModel row, so the reconciler can diff the two
directly.
reconcileNodeProcesses runs before the port probe and reaps rows for models
the worker is not running. Models the worker vouches for get updated_at
bumped, which takes them out of the port prober's stale set entirely: that is
what keeps a backend deep in a long generation away from the probe in the
first place, rather than relying on classifying its silence after the fact.
A worker that does not answer is skipped, not assumed empty. A messaging
failure says nothing about the processes, and assuming the worst would delete
a node's rows on a transient NATS blip; the port probe stays as the fallback
for those nodes. Rows younger than probeStaleAfter are ignored so a freshly
created row is never judged against a process table that has not caught up.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]
* fix(distributed): stop in_flight leaking and pin replicas against eviction
A leaked in_flight counter is not cosmetic. FindLRUModel,
FindGlobalLRUModelWithZeroInFlight and the router's eviction query all require
in_flight = 0, so a replica whose counter never came back is pinned and its
VRAM is unreclaimable for the lifetime of the process.
Two halves.
The source: routing reserves in_flight = 1 at load time so a freshly loaded
replica is not evicted out from under the request that caused the load. That
reservation was released ONLY by the first inference completing, so a route
torn down before any inference ran (client disconnect, handler error, failure
between load and the backend call) stranded it. newRouteResult now wires the
reservation to a sync.Once fired by whichever comes first, the first inference
or route teardown, and replaces three copies of the old wiring.
The backstop: a sweeper for counters leaked by paths that cannot run a defer
at all, such as a frontend killed mid-request.
Identifying a leak by elapsed time alone is unsafe. IncrementInFlight stamps
last_used at request START and nothing moves it while the request runs, so a
long generation is indistinguishable from a leak by age, and resetting there
would expose a serving model to eviction. The probe supplies the missing bit:
a backend that answers a health check promptly is not inside a request,
because that is precisely what a busy one cannot do. Requiring the row to also
be idle for 30 minutes covers backends that serve in parallel and can answer
while working, since those keep last_used fresh through each new increment.
Two existing tests asserted the old behaviour ("No decrement on Release").
That assertion was the leak, so both now pin the release instead.
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Assisted-by: Claude:claude-opus-5 [Claude Code]
---------
Signed-off-by: Ettore Di Giacinto <mudler@localai.io>
Co-authored-by: Ettore Di Giacinto <mudler@localai.io>
235 lines
10 KiB
Go
235 lines
10 KiB
Go
package distributed_test
|
|
|
|
import (
|
|
"context"
|
|
"time"
|
|
|
|
"github.com/mudler/LocalAI/core/services/nodes"
|
|
"github.com/mudler/LocalAI/core/services/nodes/prefixcache"
|
|
"github.com/mudler/LocalAI/pkg/distributedhdr"
|
|
grpcPkg "github.com/mudler/LocalAI/pkg/grpc"
|
|
pb "github.com/mudler/LocalAI/pkg/grpc/proto"
|
|
|
|
. "github.com/onsi/ginkgo/v2"
|
|
. "github.com/onsi/gomega"
|
|
|
|
ggrpc "google.golang.org/grpc"
|
|
|
|
pgdriver "gorm.io/driver/postgres"
|
|
gormDB "gorm.io/gorm"
|
|
"gorm.io/gorm/logger"
|
|
)
|
|
|
|
// prefixStubBackend implements grpc.Backend with a canned-success HealthCheck
|
|
// and LoadModel so SmartRouter.probeHealth passes and any cold load returns
|
|
// success — no real inference happens. Mirrors the stubBackend pattern used by
|
|
// the SmartRouter unit tests in core/services/nodes/router_test.go, reproduced
|
|
// here because that fake lives in the internal (unexported) nodes package.
|
|
type prefixStubBackend struct {
|
|
grpcPkg.Backend // embed so unused methods satisfy the interface; they panic only if called
|
|
|
|
healthResult bool
|
|
}
|
|
|
|
func (f *prefixStubBackend) HealthCheck(_ context.Context) (bool, error) {
|
|
return f.healthResult, nil
|
|
}
|
|
|
|
func (f *prefixStubBackend) LoadModel(_ context.Context, _ *pb.ModelOptions, _ ...ggrpc.CallOption) (*pb.Result, error) {
|
|
return &pb.Result{Success: true}, nil
|
|
}
|
|
|
|
func (f *prefixStubBackend) IsBusy() bool { return false }
|
|
|
|
// prefixStubClientFactory hands the same fake backend to every NewClient call,
|
|
// so the SmartRouter never opens a real gRPC connection during routing.
|
|
type prefixStubClientFactory struct {
|
|
client *prefixStubBackend
|
|
}
|
|
|
|
func (f *prefixStubClientFactory) NewClient(_ string, _ bool) grpcPkg.Backend {
|
|
return f.client
|
|
}
|
|
|
|
var _ = Describe("Prefix-cache aware routing", Label("Distributed"), func() {
|
|
const model = "model"
|
|
|
|
var (
|
|
infra *TestInfra
|
|
db *gormDB.DB
|
|
registry *nodes.NodeRegistry
|
|
router *nodes.SmartRouter
|
|
idx *prefixcache.Index
|
|
|
|
nodeXID string
|
|
nodeYID string
|
|
|
|
chainA = []uint64{1, 2, 3, 4, 5} // conversation A
|
|
chainShared = []uint64{1, 2, 3, 9, 9} // shares leading prefix [1,2,3] with A
|
|
chainUnrelated = []uint64{7, 8, 9} // no shared prefix with A
|
|
)
|
|
|
|
// routeAndSettle drives one request through the router for the given prefix
|
|
// chain and immediately settles the in-flight reservation the way a real
|
|
// inference completion would (Release closes the client; the DecrementInFlight
|
|
// emulates the OnFirstComplete callback that fires after the first inference).
|
|
// Settling keeps both nodes balanced at in_flight=0 so the prefix-cache load
|
|
// guard never falsely forces a request off its warm node between steps.
|
|
routeAndSettle := func(chain []uint64) string {
|
|
GinkgoHelper()
|
|
ctx := distributedhdr.WithPrefixChain(context.Background(), chain)
|
|
result, err := router.Route(ctx, model, model, "llama-cpp",
|
|
&pb.ModelOptions{ModelFile: model}, false)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
Expect(result).ToNot(BeNil())
|
|
Expect(result.Node).ToNot(BeNil())
|
|
nodeID := result.Node.ID
|
|
result.Release()
|
|
Expect(registry.DecrementInFlight(context.Background(), nodeID, model, 0)).To(Succeed())
|
|
return nodeID
|
|
}
|
|
|
|
BeforeEach(func() {
|
|
infra = SetupInfra("localai_prefix_cache_routing_test")
|
|
|
|
var err error
|
|
db, err = gormDB.Open(pgdriver.Open(infra.PGURL), &gormDB.Config{
|
|
Logger: logger.Default.LogMode(logger.Silent),
|
|
})
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
registry, err = nodes.NewNodeRegistry(db)
|
|
Expect(err).ToNot(HaveOccurred())
|
|
|
|
// The prefix-cache index is the real radix-tree provider. Keep a handle so
|
|
// the specs can assert Decide() directly in addition to observing Route().
|
|
idx = prefixcache.NewIndex(prefixcache.DefaultConfig())
|
|
|
|
// Wire the registry chokepoint hook ourselves. In production distributed.go
|
|
// wires this; a bare SmartRouter test must register it so removal-path
|
|
// invalidation is exercised end to end. A negative replica index means
|
|
// "all replicas of the node" (InvalidateNode); otherwise drop the exact
|
|
// replica.
|
|
registry.AddReplicaRemovedHook(func(modelName, nodeID string, replica int) {
|
|
if replica < 0 {
|
|
idx.InvalidateNode(modelName, nodeID)
|
|
} else {
|
|
idx.Invalidate(modelName, prefixcache.ReplicaKey{NodeID: nodeID, Replica: replica})
|
|
}
|
|
})
|
|
|
|
// Register TWO healthy nodes and mark the model loaded on both (replica 0).
|
|
nodeX := &nodes.BackendNode{Name: "node-x", Address: "127.0.0.1:50051"}
|
|
nodeY := &nodes.BackendNode{Name: "node-y", Address: "127.0.0.1:50052"}
|
|
Expect(registry.Register(context.Background(), nodeX, true)).To(Succeed())
|
|
Expect(registry.Register(context.Background(), nodeY, true)).To(Succeed())
|
|
nodeXID = nodeX.ID
|
|
nodeYID = nodeY.ID
|
|
Expect(registry.SetNodeModel(context.Background(), nodeXID, model, 0, "loaded", "", 0)).To(Succeed())
|
|
Expect(registry.SetNodeModel(context.Background(), nodeYID, model, 0, "loaded", "", 0)).To(Succeed())
|
|
|
|
factory := &prefixStubClientFactory{client: &prefixStubBackend{healthResult: true}}
|
|
router = nodes.NewSmartRouter(registry, nodes.SmartRouterOptions{
|
|
ClientFactory: factory,
|
|
PrefixProvider: idx,
|
|
PrefixConfig: prefixcache.DefaultConfig(),
|
|
DB: db,
|
|
})
|
|
})
|
|
|
|
It("locks affinity, honors shared prefixes, isolates unrelated chains, and re-homes on failover", func() {
|
|
now := time.Now()
|
|
// Both nodes host replica 0 of the model.
|
|
keys := []prefixcache.ReplicaKey{{NodeID: nodeXID, Replica: 0}, {NodeID: nodeYID, Replica: 0}}
|
|
|
|
// --- Step 1: cold miss + observe -------------------------------------
|
|
// chainA's prefix has never been seen, so there is no hot match yet; the
|
|
// request cold-places on some loaded node X and the assignment is recorded.
|
|
Expect(idx.Decide(model, chainA, keys, now).HasHot).To(BeFalse(),
|
|
"step 1: chainA must be a cold miss (no prior affinity)")
|
|
placedNode := routeAndSettle(chainA)
|
|
Expect(placedNode).To(Or(Equal(nodeXID), Equal(nodeYID)))
|
|
// From here on, "X" is whichever node served chainA first.
|
|
nodeX := placedNode
|
|
var nodeY string
|
|
if nodeX == nodeXID {
|
|
nodeY = nodeYID
|
|
} else {
|
|
nodeY = nodeXID
|
|
}
|
|
hotX := prefixcache.ReplicaKey{NodeID: nodeX, Replica: 0}
|
|
Expect(idx.Decide(model, chainA, keys, time.Now()).Hot).To(Equal(hotX),
|
|
"step 1: chainA must now be recorded against the replica that served it")
|
|
|
|
// --- Step 2: hot-match affinity --------------------------------------
|
|
// The SAME chain routes back to X.
|
|
Expect(routeAndSettle(chainA)).To(Equal(nodeX),
|
|
"step 2: a repeat of chainA must return to its warm node X")
|
|
|
|
// --- Step 3: shared-prefix match (the regression we fixed) -----------
|
|
// A DIFFERENT chain that shares the leading prefix [1,2,3] with X's chain
|
|
// but diverges at the tail still matches the shared head and routes to X.
|
|
// Before the radix-tree fix this fell through to a cold placement.
|
|
Expect(idx.Decide(model, chainShared, keys, time.Now()).Hot).To(Equal(hotX),
|
|
"step 3: chainShared must hot-match X on the shared prefix")
|
|
Expect(routeAndSettle(chainShared)).To(Equal(nodeX),
|
|
"step 3: chainShared must route to X via the shared-prefix match")
|
|
|
|
// --- Step 4: negative control ----------------------------------------
|
|
// A completely unrelated chain shares no prefix with X's chain, so it must
|
|
// NOT hot-match X's affinity. (Cold placement may still pick X or Y by
|
|
// load/cacheWeight, but it must not be a false hot match.) Asserting the
|
|
// provider decision directly is the robust check.
|
|
Expect(idx.Decide(model, chainUnrelated, keys, time.Now()).HasHot).To(BeFalse(),
|
|
"step 4: chainUnrelated must be a cold miss, not a false hot match on X")
|
|
|
|
// --- Step 5: failover + invalidation ---------------------------------
|
|
// Remove node X's replica of the model. This fires the registry chokepoint
|
|
// hook, which invalidates the prefix-cache entry for X. A request for X's
|
|
// chain must then fail over to the surviving node Y, and the prefix entry
|
|
// must no longer pin to X (it re-homes to Y on the next observe).
|
|
Expect(registry.RemoveAllNodeModelReplicas(context.Background(), nodeX, model)).To(Succeed())
|
|
|
|
yKeys := []prefixcache.ReplicaKey{{NodeID: nodeY, Replica: 0}}
|
|
// The chokepoint hook dropped X from the index immediately.
|
|
Expect(idx.Decide(model, chainA, yKeys, time.Now()).Hot).ToNot(Equal(hotX),
|
|
"step 5: after X's replica is removed, chainA must no longer pin to X")
|
|
|
|
// Route(chainA): only Y still hosts the model, so it fails over to Y.
|
|
Expect(routeAndSettle(chainA)).To(Equal(nodeY),
|
|
"step 5: chainA must fail over to the surviving node Y")
|
|
|
|
// And the entry has re-homed: chainA now hot-matches Y, never X.
|
|
reHomed := idx.Decide(model, chainA, yKeys, time.Now())
|
|
hotY := prefixcache.ReplicaKey{NodeID: nodeY, Replica: 0}
|
|
Expect(reHomed.Hot).ToNot(Equal(hotX),
|
|
"step 5: chainA must not re-home to the removed node X")
|
|
Expect(reHomed.Hot).To(Equal(hotY),
|
|
"step 5: chainA must re-home to the surviving node Y")
|
|
})
|
|
|
|
It("tracks affinity per replica when ONE node hosts TWO replicas of the model", func() {
|
|
// This is the bug the replica-granular change fixes: two replicas of the
|
|
// same model on the SAME node are distinct KV caches. A prefix observed
|
|
// on replica (node,0) must NOT be reported as hot on the sibling replica
|
|
// (node,1) of the same node.
|
|
const multiNodeModel = "multi-replica-model"
|
|
multiNode := &nodes.BackendNode{Name: "node-multi", Address: "127.0.0.1:50060", MaxReplicasPerModel: 2}
|
|
Expect(registry.Register(context.Background(), multiNode, true)).To(Succeed())
|
|
Expect(registry.SetNodeModel(context.Background(), multiNode.ID, multiNodeModel, 0, "loaded", "addr0", 0)).To(Succeed())
|
|
Expect(registry.SetNodeModel(context.Background(), multiNode.ID, multiNodeModel, 1, "loaded", "addr1", 0)).To(Succeed())
|
|
|
|
chain := []uint64{42, 43, 44}
|
|
key0 := prefixcache.ReplicaKey{NodeID: multiNode.ID, Replica: 0}
|
|
key1 := prefixcache.ReplicaKey{NodeID: multiNode.ID, Replica: 1}
|
|
|
|
// Observe the chain on replica 0 only.
|
|
idx.Observe(multiNodeModel, chain, key0, time.Now())
|
|
|
|
d := idx.Decide(multiNodeModel, chain, []prefixcache.ReplicaKey{key0, key1}, time.Now())
|
|
Expect(d.HasHot).To(BeTrue())
|
|
Expect(d.Hot).To(Equal(key0),
|
|
"the prefix was served by replica 0; the SAME-node sibling replica 1 must NOT be chosen")
|
|
})
|
|
})
|