Approvals and Apply
Approval records authorization; the browser request never calls ONTAP. It requests an immediate reconcile, which re-observes identity and policy before any destination write.
Queue tabs
| Tab | Meaning |
|---|---|
| Pending | Human-gated proposals that can be approved, rejected, or deferred |
| Backlog | Candidates waiting for age, admission capacity, prioritization, or another guardrail |
| Apply | Approved work and active persisted provisioning intents |
| Cleanup | Orphan cleanup requiring explicit destructive confirmation |
Use the automation-profile filter to confirm which policy owns Pending, Backlog, Apply, and Cleanup work. Managed relationships also expose their automation profile after provisioning or adopted-relationship binding.
Provisioning sequence
Each step persists its checkpoint and ONTAP job UUID. A 15-second provisioning follow-up advances
non-baseline steps without waiting for the normal five-minute reconcile. Once the baseline starts,
normal observation monitors it until ONTAP reports snapmirrored.
max_actions_per_run controls how much approved preparation can be admitted. Baselines are
separately constrained by max_concurrent_initializes and the intercluster budget. Approving 100
volumes therefore does not create a five-minute pause between every API step, but it also does not
bypass the configured baseline bandwidth limit.
Revalidation and dry-run
Before execution, DonkeyFleet rechecks:
- effective dry-run;
- current source and destination UUIDs;
- current group and profile membership;
- placement, schedule, action, and payload validity;
- baseline concurrency and bandwidth;
- complete observation and source-role protection.
Approved work can remain authorized while dry-run is on, but it cannot mutate ONTAP. When Apply becomes live, a new reconcile must still validate it.
Crash and restart recovery
PostgreSQL is required recovery state, not just application data. After a pod, node, or process restart, DonkeyFleet loads the checkpoint, observes ONTAP, and resumes or polls the existing job. It does not restart the workflow from the beginning or blindly reissue an unresolved create.
If submission ended without a persisted job UUID, the intent becomes indeterminate and the next run performs discovery-only recovery. Preserve and back up PostgreSQL throughout provisioning.
During initialization, ONTAP can report uninitialized and unhealthy for hours. That is expected
and is distinct from DonkeyFleet lifecycle suspended.