drain haproxy on shutdown and keep the stats listener on loopback

apps/base/haproxy/configmap.yaml

@@ -54,6 +54,7 @@ data:
       log stdout format raw local0
       log stdout format raw local1 notice
       maxconn  4000
+      hard-stop-after  2m
       ssl-default-bind-ciphers  EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH
       ssl-default-bind-options  ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.3
       ssl-default-server-ciphers  kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
@@ -478,7 +479,7 @@ data:
       monitor-uri /healthz
 
     listen stats
-      bind 0.0.0.0:9090
+      bind 127.0.0.1:9090
       mode http
       stats uri /
       stats auth admin:admin

apps/base/haproxy/deployment.yaml

@@ -21,6 +21,7 @@ spec:
         app: haproxy
     spec:
       automountServiceAccountToken: false
+      terminationGracePeriodSeconds: 150
       affinity:
         podAntiAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
@@ -79,6 +80,15 @@ spec:
             - name: stats
               containerPort: 9090
               protocol: TCP
+          lifecycle:
+            preStop:
+              exec:
+                # SIGUSR1 to the master soft-stops the workers; hard-stop-after
+                # caps the drain. Wait so kubelet holds SIGTERM until it is done.
+                command:
+                  - /bin/sh
+                  - -c
+                  - kill -s USR1 1; while kill -0 1 2>/dev/null; do sleep 1; done
           livenessProbe:
             httpGet:
               path: /healthz