template 0.7.3: releases never leave the Service empty — surge rollout, graceful drain, opt-in HA #17

Merged

plat merged 1 commit from zero-downtime-rollout into main

2026-08-24 18:31:19 +00:00

plat commented

2026-08-24 18:29:42 +00:00

Owner

Chart: strategy: RollingUpdate (maxSurge: 1, maxUnavailable: 0) + minReadySeconds: 5 replaces Recreate — the new pod starts beside the old one, must pass startup/readiness and stay Ready 5 s, only then is the old pod retired; a pod that never becomes Ready leaves the old one serving and Flux's HelmRelease wait + rollback remediation revert the release. preStop: sleep 5 lets the endpoint removal reach Traefik before SIGTERM. New replicas value (default 1); a PodDisruptionBudget (minAvailable 1) renders only at 2+ so a single replica never blocks a node drain.

Server: SIGTERM/SIGINT drain in-flight requests via app.close(), hard exit at 10 s.

Why the RWO /data PVC is fine for the overlap: local-path pins the PV to a node, so the surge pod schedules onto the same node (RWO = one node, not one pod), and the template never writes there.

The fleet-wide counterpart is the zero-downtime-rollout Kyverno mutate policy in plat/gitops, which asserts the same strategy on every existing app's next rollout (185 web Deployments were Recreate). This PR makes the template tell the same truth for apps born from now on.

typecheck clean, 37/37 tests.

**Chart:** `strategy: RollingUpdate` (`maxSurge: 1`, `maxUnavailable: 0`) + `minReadySeconds: 5` replaces `Recreate` — the new pod starts beside the old one, must pass startup/readiness and stay Ready 5 s, only then is the old pod retired; a pod that never becomes Ready leaves the old one serving and Flux's HelmRelease wait + rollback remediation revert the release. `preStop: sleep 5` lets the endpoint removal reach Traefik before SIGTERM. New `replicas` value (default 1); a `PodDisruptionBudget` (minAvailable 1) renders only at 2+ so a single replica never blocks a node drain. **Server:** SIGTERM/SIGINT drain in-flight requests via `app.close()`, hard exit at 10 s. **Why the RWO `/data` PVC is fine for the overlap:** local-path pins the PV to a node, so the surge pod schedules onto the same node (RWO = one node, not one pod), and the template never writes there. The fleet-wide counterpart is the `zero-downtime-rollout` Kyverno mutate policy in plat/gitops, which asserts the same strategy on every existing app's next rollout (185 web Deployments were `Recreate`). This PR makes the template tell the same truth for apps born from now on. `typecheck` clean, 37/37 tests.

plat added 1 commit

2026-08-24 18:29:42 +00:00

template 0.7.3: releases never leave the Service empty — surge rollout, graceful drain, opt-in HA

guard-ppt / no-ppt (pull_request) Successful in 0s

Details

guard-ppt / no-ppt (push) Successful in 0s

Details

check / check (push) Successful in 24s

Details

check / check (pull_request) Successful in 23s

Details

preview / preview (pull_request) Failing after 1s

Details

fba8d8898c

chart: strategy RollingUpdate maxSurge 1 / maxUnavailable 0 +
minReadySeconds 5 (was Recreate: kill first, then start — ~30-40s of 503
per release); preStop sleep so the endpoint removal reaches Traefik
before SIGTERM; `replicas` value (default 1) and a PodDisruptionBudget
rendered only at 2+ so a single replica never blocks a drain.
server: SIGTERM/SIGINT drain in-flight requests via app.close(), hard
exit at 10s. The RWO /data PVC is fine for the overlap: local-path pins
the PV to a node, so the surge pod lands beside the old one. The
platform's zero-downtime-rollout Kyverno policy asserts the same strategy
for every existing app; this makes the template tell the same truth.

plat merged commit 7ffeb8d8ab into main

2026-08-24 18:31:19 +00:00

plat deleted branch zero-downtime-rollout

2026-08-24 18:31:19 +00:00

plat referenced this pull request from a commit

2026-08-24 18:31:20 +00:00

template 0.7.3: releases never leave the Service empty — surge rollout, graceful drain, opt-in HA (#17)