release(aisix-cp): 0.5.1

charts/aisix-cp/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: aisix-cp
 description: Helm chart for AISIX control plane (cp-api, dp-manager, dashboard)
 type: application
-version: 0.5.0
+version: 0.5.1
 appVersion: "0.5.0"
 
 maintainers:

charts/aisix-cp/README.md

@@ -1,6 +1,6 @@
 # aisix-cp
 
-![Version: 0.5.0](https://img.shields.io/badge/Version-0.5.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0](https://img.shields.io/badge/AppVersion-0.5.0-informational?style=flat-square)
+![Version: 0.5.1](https://img.shields.io/badge/Version-0.5.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: 0.5.0](https://img.shields.io/badge/AppVersion-0.5.0-informational?style=flat-square)
 
 Helm chart for AISIX control plane (cp-api, dp-manager, dashboard)
 

charts/aisix-cp/templates/api-deployment.yaml

@@ -90,6 +90,18 @@ spec:
             {{- with .Values.api.extraEnvVars }}
             {{- toYaml . | nindent 12 }}
             {{- end }}
+          # cp-api runs the schema migration (db.OpenAndMigrate) before
+          # it binds :8080, so /healthz does not answer for the whole
+          # migration. On an upgrade against a populated database that
+          # can outlast the liveness budget below and kill the pod
+          # MID-MIGRATION. The startupProbe suspends liveness and
+          # readiness until the server is actually up.
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            periodSeconds: 5
+            failureThreshold: 60
           livenessProbe:
             httpGet:
               path: /healthz

charts/aisix-cp/templates/dpm-deployment.yaml

@@ -70,7 +70,24 @@ spec:
           # Service) and liveness (pod restarted). When the health
           # listener is disabled (healthListen=""), the dp-manager serves
           # no /healthz, so fall back to a TCP check on the mTLS port.
+          #
+          # On a cold start the dp-manager binds NEITHER port until
+          # bootstrapCertManagerWithRetry succeeds: cp-api owns the
+          # schema migration, so on a first boot dp-manager sits in an
+          # in-process retry loop (~2 min budget) waiting for the shared
+          # tables to appear. The liveness settings below would kill it
+          # ~30s in — well inside its own retry window — turning a
+          # benign, self-healing boot race into a crash loop. The
+          # startupProbe suspends liveness and readiness until the first
+          # success, with a budget that must stay LONGER than that
+          # in-process retry window (see ci-helm.yml, which asserts it).
           {{- if .Values.dpm.service.healthListen }}
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: health
+            periodSeconds: 5
+            failureThreshold: 36
           readinessProbe:
             httpGet:
               path: /healthz
@@ -85,6 +102,11 @@ spec:
             periodSeconds: 10
             failureThreshold: 3
           {{- else }}
+          startupProbe:
+            tcpSocket:
+              port: tls
+            periodSeconds: 5
+            failureThreshold: 36
           readinessProbe:
             tcpSocket:
               port: tls