From 67c0ac3c615bcbff64f7ed6ac60d0f5ef6dde654 Mon Sep 17 00:00:00 2001 From: Jarvis Date: Fri, 24 Jul 2026 17:44:32 +0800 Subject: [PATCH] release(aisix-cp): 0.5.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Chart-only patch on top of the 0.5.0 app release: add a startupProbe to cp-api and dp-manager so the liveness probe stops killing them while they are still legitimately bootstrapping. appVersion stays 0.5.0 — no application change. dp-manager binds neither of its ports until it has obtained the shared schema, which cp-api creates; on a first boot it retries in-process for ~95s waiting for that. The liveness probe killed it about 40s in, well inside that window, so a benign boot race became a crash loop. cp-api has the same shape: it runs its migration before binding :8080, so /healthz stays unanswered for the whole migration and an upgrade against a populated database can be killed mid-migration. While a startup probe is in effect the kubelet suspends liveness and readiness, so the existing probes are unchanged and take over once the process is serving. Budgets outlast the work they cover: 180s for dp-manager, 300s for cp-api's migration. Synced from the source-of-truth chart in AISIX-Cloud#1135. --- charts/aisix-cp/Chart.yaml | 2 +- charts/aisix-cp/README.md | 2 +- charts/aisix-cp/templates/api-deployment.yaml | 12 ++++++++++ charts/aisix-cp/templates/dpm-deployment.yaml | 22 +++++++++++++++++++ 4 files changed, 36 insertions(+), 2 deletions(-) diff --git a/charts/aisix-cp/Chart.yaml b/charts/aisix-cp/Chart.yaml index 875970c..c3f83cc 100644 --- a/charts/aisix-cp/Chart.yaml +++ b/charts/aisix-cp/Chart.yaml @@ -2,7 +2,7 @@ apiVersion: v2 name: aisix-cp description: Helm chart for AISIX control plane (cp-api, dp-manager, dashboard) type: application -version: 0.5.0 +version: 0.5.1 appVersion: "0.5.0" maintainers: diff --git a/charts/aisix-cp/README.md b/charts/aisix-cp/README.md index ca461e9..48a1097 100644 --- a/charts/aisix-cp/README.md +++ b/charts/aisix-cp/README.md @@ -1,6 +1,6 @@ # aisix-cp -![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0](https://img.shields.io/badge/AppVersion-0.5.0-informational?style=flat-square) +![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0](https://img.shields.io/badge/AppVersion-0.5.0-informational?style=flat-square) Helm chart for AISIX control plane (cp-api, dp-manager, dashboard) diff --git a/charts/aisix-cp/templates/api-deployment.yaml b/charts/aisix-cp/templates/api-deployment.yaml index 68bc1ce..2da0c9a 100644 --- a/charts/aisix-cp/templates/api-deployment.yaml +++ b/charts/aisix-cp/templates/api-deployment.yaml @@ -90,6 +90,18 @@ spec: {{- with .Values.api.extraEnvVars }} {{- toYaml . | nindent 12 }} {{- end }} + # cp-api runs the schema migration (db.OpenAndMigrate) before + # it binds :8080, so /healthz does not answer for the whole + # migration. On an upgrade against a populated database that + # can outlast the liveness budget below and kill the pod + # MID-MIGRATION. The startupProbe suspends liveness and + # readiness until the server is actually up. + startupProbe: + httpGet: + path: /healthz + port: http + periodSeconds: 5 + failureThreshold: 60 livenessProbe: httpGet: path: /healthz diff --git a/charts/aisix-cp/templates/dpm-deployment.yaml b/charts/aisix-cp/templates/dpm-deployment.yaml index 4ca5edf..b32664d 100644 --- a/charts/aisix-cp/templates/dpm-deployment.yaml +++ b/charts/aisix-cp/templates/dpm-deployment.yaml @@ -70,7 +70,24 @@ spec: # Service) and liveness (pod restarted). When the health # listener is disabled (healthListen=""), the dp-manager serves # no /healthz, so fall back to a TCP check on the mTLS port. + # + # On a cold start the dp-manager binds NEITHER port until + # bootstrapCertManagerWithRetry succeeds: cp-api owns the + # schema migration, so on a first boot dp-manager sits in an + # in-process retry loop (~2 min budget) waiting for the shared + # tables to appear. The liveness settings below would kill it + # ~30s in — well inside its own retry window — turning a + # benign, self-healing boot race into a crash loop. The + # startupProbe suspends liveness and readiness until the first + # success, with a budget that must stay LONGER than that + # in-process retry window (see ci-helm.yml, which asserts it). {{- if .Values.dpm.service.healthListen }} + startupProbe: + httpGet: + path: /healthz + port: health + periodSeconds: 5 + failureThreshold: 36 readinessProbe: httpGet: path: /healthz @@ -85,6 +102,11 @@ spec: periodSeconds: 10 failureThreshold: 3 {{- else }} + startupProbe: + tcpSocket: + port: tls + periodSeconds: 5 + failureThreshold: 36 readinessProbe: tcpSocket: port: tls