@cyc-seattle/platform 0.4.0 → 0.5.0

package/README.md

@@ -92,7 +92,8 @@ GitHub environment that holds its identity and state bucket:
 | Push to `main` | `ci`, `dev`, then `prod-preview`, then `prod`, which waits for the `maintainers` approval |
 
 `prod-preview` runs `mise run preview` as `deploy-runner` and writes the diff to the job summary.
-`prod` runs `mise run deploy` on the same commit once approved. A PR from a fork gets no OIDC token,
+`prod` runs `mise run deploy` on the same commit once approved. It runs only when the preview shows
+changes in `cloud` or `cluster`, so a merge that changes nothing in prod asks for no approval. A PR from a fork gets no OIDC token,
 so its `dev` job is skipped.
 
 `PULUMI_STACK` picks what the tasks run (`scripts/each-stack`): `dev` is `smoke`, and `prod` is

package/dist/workload.d.ts

@@ -51,6 +51,12 @@ export interface WorkloadArgs extends PodArgs {
     startupProbe?: Probe;
     /** Defaults to 1. */
     replicas?: number;
+    /** Annotations on each pod, such as `cluster-autoscaler.kubernetes.io/safe-to-evict`. */
+    podAnnotations?: Record<string, string>;
+    /** Prefers pods in different zones. A preference, so one zone's capacity can still schedule them all. */
+    spreadAcrossZones?: boolean;
+    /** Adds a PodDisruptionBudget that keeps this many pods up through drains. Must be below `replicas`. */
+    minAvailable?: number;
 }
 /** The pods' Workload Identity principal, for IAM grants. */
 export declare function workloadMember(platform: pulumi.Output<PlatformOutputs>, serviceAccountName: pulumi.Input<string>): pulumi.Output<string>;

package/dist/workload.js

@@ -128,23 +128,43 @@ function deployment(parent, name, args, http) {
         // The API rejects two ports with one name, and only after the preview.
         throw new Error(`${name}: "ports" can't name a port "http"; a WebService's own port has that name.`);
     }
+    const replicas = args.replicas ?? 1;
+    if (args.minAvailable !== undefined && args.minAvailable >= replicas) {
+        // Such a budget blocks every drain, so node upgrades stall on it.
+        throw new Error(`${name}: "minAvailable" (${args.minAvailable}) must be below "replicas" (${replicas}).`);
+    }
     const ports = [...(http !== undefined ? [{ name: "http", port: http }] : []), ...(args.ports ?? [])];
     new k8s.apps.v1.Deployment(name, {
         metadata,
         spec: {
-            replicas: args.replicas ?? 1,
+            replicas,
             selector: { matchLabels: labels },
             template: {
-                metadata: { labels },
+                metadata: { labels, ...(args.podAnnotations && { annotations: args.podAnnotations }) },
                 spec: podSpec(name, args, account.metadata.name, {
                     ...(ports.length > 0 && { ports: ports.map((p) => ({ name: p.name, containerPort: p.port })) }),
                     ...(args.readinessProbe && { readinessProbe: args.readinessProbe }),
                     ...(args.livenessProbe && { livenessProbe: args.livenessProbe }),
                     ...(args.startupProbe && { startupProbe: args.startupProbe }),
-                }),
+                }).apply((spec) => ({
+                    ...spec,
+                    ...(args.spreadAcrossZones && {
+                        topologySpreadConstraints: [
+                            {
+                                maxSkew: 1,
+                                topologyKey: "topology.kubernetes.io/zone",
+                                whenUnsatisfiable: "ScheduleAnyway",
+                                labelSelector: { matchLabels: labels },
+                            },
+                        ],
+                    }),
+                })),
             },
         },
     }, child);
+    if (args.minAvailable !== undefined) {
+        new k8s.policy.v1.PodDisruptionBudget(name, { metadata, spec: { minAvailable: args.minAvailable, selector: { matchLabels: labels } } }, child);
+    }
     if (ports.length === 0) {
         return { serviceAccount: account };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyc-seattle/platform",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Pulumi components for CYC's shared Google Cloud platform: WebService, the platform outputs reader, and the stacks that build the platform",
   "author": "CYC Community Sailing Center",
   "license": "Apache-2.0",
@@ -18,7 +18,7 @@
   "engines": {
     "node": ">=22"
   },
-  "packageManager": "pnpm@10.34.6",
+  "packageManager": "pnpm@10.34.7",
   "prettier": "@cyc-seattle/ts-config/prettier",
   "exports": {
     ".": {
@@ -46,11 +46,11 @@
     "@amiceli/vitest-cucumber": "7.0.0",
     "@cyc-seattle/ts-config": "^0.1.2",
     "@pulumi/command": "1.2.1",
-    "@pulumi/gcp": "10.1.1",
+    "@pulumi/gcp": "10.2.0",
     "@pulumi/github": "6.15.0",
     "@pulumi/kubernetes": "4.34.2",
-    "@pulumi/pulumi": "3.264.0",
-    "@pulumi/random": "4.21.3",
+    "@pulumi/pulumi": "3.270.0",
+    "@pulumi/random": "4.21.4",
     "@types/js-yaml": "4.0.9",
     "@types/node": "^22.19.1",
     "eslint": "^9.39.5",