maintenance: serialize sweeper startup around offline pods

services/maintenance/node-ops/node-image-sweeper-daemonset.yaml

@@ -11,7 +11,8 @@ spec:
   updateStrategy:
     type: RollingUpdate
     rollingUpdate:
-      maxUnavailable: 1
+      # Two unreachable old pods consume the budget; replace one reachable pod.
+      maxUnavailable: 3
   template:
     metadata:
       annotations:
@@ -41,6 +42,12 @@ spec:
         - name: node-image-sweeper
           image: python:3.12.9-alpine3.20
           command: ["/bin/sh", "/scripts/node_image_sweeper.sh"]
+          startupProbe:
+            exec:
+              command: ["/bin/sh", "-c", "test -f /tmp/initial-sweep-complete"]
+            periodSeconds: 5
+            timeoutSeconds: 5
+            failureThreshold: 120
           env:
             - name: SWEEP_INTERVAL_SEC
               value: "7200"

services/maintenance/node-ops/scripts/node_image_sweeper.sh

@@ -41,6 +41,7 @@ sweep_once() {
 }
 
 sweep_once
+touch /tmp/initial-sweep-complete
 
 if [ "${ONE_SHOT}" = "true" ]; then
   exit 0