From 2cbac810157129c782f73b01a3bf7557c1f7742c Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Sat, 26 Sep 2026 14:38:25 +1000 Subject: [PATCH] drain haproxy on shutdown and keep the stats listener on loopback --- apps/base/haproxy/configmap.yaml | 3 ++- apps/base/haproxy/deployment.yaml | 10 ++++++++++ 2 files changed, 12 insertions(+), 1 deletion(-) diff --git a/apps/base/haproxy/configmap.yaml b/apps/base/haproxy/configmap.yaml index 441908f..14f9ee7 100644 --- a/apps/base/haproxy/configmap.yaml +++ b/apps/base/haproxy/configmap.yaml @@ -54,6 +54,7 @@ data: log stdout format raw local0 log stdout format raw local1 notice maxconn 4000 + hard-stop-after 2m ssl-default-bind-ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH ssl-default-bind-options ssl-min-ver TLSv1.2 ssl-max-ver TLSv1.3 ssl-default-server-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL @@ -478,7 +479,7 @@ data: monitor-uri /healthz listen stats - bind 0.0.0.0:9090 + bind 127.0.0.1:9090 mode http stats uri / stats auth admin:admin diff --git a/apps/base/haproxy/deployment.yaml b/apps/base/haproxy/deployment.yaml index ca849ef..4a1f11e 100644 --- a/apps/base/haproxy/deployment.yaml +++ b/apps/base/haproxy/deployment.yaml @@ -21,6 +21,7 @@ spec: app: haproxy spec: automountServiceAccountToken: false + terminationGracePeriodSeconds: 150 affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: @@ -79,6 +80,15 @@ spec: - name: stats containerPort: 9090 protocol: TCP + lifecycle: + preStop: + exec: + # SIGUSR1 to the master soft-stops the workers; hard-stop-after + # caps the drain. Wait so kubelet holds SIGTERM until it is done. + command: + - /bin/sh + - -c + - kill -s USR1 1; while kill -0 1 2>/dev/null; do sleep 1; done livenessProbe: httpGet: path: /healthz