@cyc-seattle/platform 1.39.4 → 1.40.1

package/README.md

@@ -31,11 +31,13 @@ app owns. The apps that run on it live in their own repos, such as
   one replica, `spreadAcrossZones` spreads them, and `minAvailable` adds a PodDisruptionBudget.
   `podAnnotations` sets annotations such as `cluster-autoscaler.kubernetes.io/safe-to-evict`. A
   pod with `safe-to-evict: "false"` gets at least 500m CPU and 512Mi from Autopilot, so ask for that
-  much, or every preview shows a change.
+  much, or every preview shows a change. `progressDeadlineSeconds` gives a slow rollout longer than
+  Kubernetes' 600 seconds before the deploy fails.
 - `WebService` is a `Workload` behind the environment's Gateway at `hostname`. Its Service exposes
   `port` as port 80, and its readiness probe must be an HTTP GET, which the load balancer's health
   check reuses unless `healthCheck.path` names a cheaper path. With `paths`, it claims only those path prefixes on `hostname`, and another
-  `WebService` can serve the rest of it.
+  `WebService` can serve the rest of it. A stopping pod keeps serving for 10 seconds, while the load
+  balancer stops sending to it, then has 30 seconds to exit.
 - `ScheduledJob` runs a CronJob on `schedule`, in `America/Los_Angeles` unless `timeZone` says
   otherwise. A run never overlaps the one before it, gets an hour, and doesn't retry, by default.
 - All three run non-root with a read-only root filesystem, no capabilities, and no service account

package/dist/schema/index.d.ts

@@ -68,6 +68,7 @@ export interface Schema {
     registrations: Registrations[];
     resource_kinds: ResourceKinds[];
     schools: Schools[];
+    sync_leases: SyncLeases[];
     sync_runs: SyncRuns[];
     sync_tasks: SyncTasks[];
     version_set_members: VersionSetMembers[];
@@ -1058,6 +1059,14 @@ export interface Schools {
     /** Other ways families write this school on their Clubspot forms. An answer matching the name or one of these, ignoring capitals and punctuation and counting a run of spaces as one, is this school. Anything else is kept as their own words. */
     aliases: string[] | null;
 }
+/** Which syncs are running now. A sync holds its queue while it runs, so a second run waits its turn. Written by the syncs. */
+export interface SyncLeases {
+    id: string;
+    /** Which sync's queue is held. A queue has one lease at a time. */
+    queue: string;
+    /** The running sync renews this every minute. Once it passes, the sync has stopped, and the next run takes the queue. */
+    expires_at: string;
+}
 /** One row each time a sync runs. */
 export interface SyncRuns {
     id: string;

package/dist/workload.d.ts

@@ -65,6 +65,8 @@ export interface WorkloadArgs extends PodArgs {
     spreadAcrossZones?: boolean;
     /** Adds a PodDisruptionBudget that keeps this many pods up through drains. Must be below `replicas`. */
     minAvailable?: number;
+    /** How long a rollout may take before the Deployment, and so the deploy, fails. Defaults to 600. */
+    progressDeadlineSeconds?: number;
 }
 /** The pods' Workload Identity principal, for IAM grants. */
 export declare function workloadMember(platform: pulumi.Output<PlatformOutputs>, serviceAccountName: pulumi.Input<string>): pulumi.Output<string>;

package/dist/workload.js

@@ -79,6 +79,7 @@ export function podSpec(name, args, serviceAccountName, container = {}) {
         ],
     }));
 }
+const preStopSeconds = 10;
 /**
  * The Deployment, ServiceAccount, and Service of a `Workload` or a `WebService`, as children of
  * `parent`. `http` is a `WebService`'s port, which its Service exposes as port 80.
@@ -99,10 +100,16 @@ export function deployment(parent, name, args, http) {
         throw new Error(`${name}: "minAvailable" (${args.minAvailable}) must be below "replicas" (${replicas}).`);
     }
     const ports = [...(http !== undefined ? [{ name: "http", port: http }] : []), ...(args.ports ?? [])];
+    // The load balancer keeps sending to a stopping pod for a few seconds (cyc-seattle/platform#153), so
+    // a WebService's pod keeps serving that long before it gets SIGTERM, then has the default 30s to exit.
+    const drain = http !== undefined && {
+        lifecycle: { preStop: { sleep: { seconds: preStopSeconds } } },
+    };
     new k8s.apps.v1.Deployment(name, {
         metadata,
         spec: {
             replicas,
+            ...(args.progressDeadlineSeconds !== undefined && { progressDeadlineSeconds: args.progressDeadlineSeconds }),
             selector: { matchLabels: labels },
             template: {
                 metadata: { labels, ...(args.podAnnotations && { annotations: args.podAnnotations }) },
@@ -111,8 +118,10 @@ export function deployment(parent, name, args, http) {
                     ...(args.readinessProbe && { readinessProbe: args.readinessProbe }),
                     ...(args.livenessProbe && { livenessProbe: args.livenessProbe }),
                     ...(args.startupProbe && { startupProbe: args.startupProbe }),
+                    ...drain,
                 }).apply((spec) => ({
                     ...spec,
+                    ...(drain && { terminationGracePeriodSeconds: preStopSeconds + 30 }),
                     ...(args.spreadAcrossZones && {
                         topologySpreadConstraints: [
                             {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cyc-seattle/platform",
-  "version": "1.39.4",
+  "version": "1.40.1",
   "description": "Pulumi components for CYC's shared Google Cloud platform: WebService, the platform outputs reader, and the stacks that build the platform",
   "author": "CYC Community Sailing Center",
   "license": "Apache-2.0",