[fabianekc]

Summary

• Image by digest. kubernetes/deployment.yaml names
  oydeu/dpplint@sha256:… with imagePullPolicy: IfNotPresent instead of
  latest with Always. All replicas run the same image, and a restart never
  picks up a newer one. DOCKERHUB=1 ./build.sh pushes the image and writes
  its digest into the manifest; the README describes the step. kubernetes/
  is excluded from the image (.dockerignore), so writing the digest does not
  change the image.
• Spread and disruption budget. topologySpreadConstraints over
  kubernetes.io/hostname (maxSkew: 1, whenUnsatisfiable: ScheduleAnyway)
  and kubernetes/pdb.yaml with minAvailable: 1 for app=dpplint. The
  rolling update (maxUnavailable: 0, maxSurge: 1) is not affected by the
  budget, which applies to evictions such as a node drain.
• Readiness with the SOyA web-cli. New GET /ready, used as readiness
  probe.
  • It answers 200 when the SOyA web-cli (/api/v1/version) and the SOyA
    repository (HEAD of one structure of the image) answer, and 503 with the
    reason when not.
  • The result is held: renewed at most every 30 s, every second while not
    ready.
  • Each question is a local request with 0.25 s to connect and 0.5 s to
    answer, so the probe (every 5 s, 2 s limit) starts no process.
  • Only one question runs at a time.
  • GET /version is unchanged.

Checks

• Test suite in the image: 253 runs, 0 failures (241 before).
  • The new tests cover ready, web-cli down, error or HTML answers, a hanging
    web-cli (ends below 1 s, nothing left open), a missing repository, a
    missing structure and no structures.
  • They also cover the held result (30 s and 1 s), a web-cli that stops after
    it was ready, one question at a time, and /version with the same fields
    without the web-cli.
• Counter-check: 11 of the 12 new tests fail on main. The 12th, about
  /version, passes on both, as it should.
• Container:
  • Ready about 1.6 s after the start; /ready takes 8 ms (median of 20).
  • Web-cli stopped: 503 "SOyA web-cli not reachable" after 21 s.
  • Image without the web-cli: 503 from the start.
  • Repository stopped: 503 "SOyA repository not reachable".
  • /version answers 200 throughout.
• Manifests: kubeconform -strict against Kubernetes 1.30: deployment,
  pod disruption budget, service, ingress and certificate are valid.
• Digest step: build.sh tested with a stub docker. The manifest gets
  exactly the pushed oydeu/dpplint@sha256: digest; a second run works too.