traefik: isolate ingress on stable NVMe control planes

infrastructure/traefik/deployment.yaml

@@ -15,8 +15,8 @@ items:
         app: traefik
     strategy:
       rollingUpdate:
-        maxSurge: 25%
+        maxSurge: 1
-        maxUnavailable: 25%
+        maxUnavailable: 0
       type: RollingUpdate
     template:
       metadata:
@@ -46,12 +46,36 @@ items:
           - --entrypoints.websecure.transport.respondingTimeouts.readTimeout=0s
           - --entrypoints.websecure.transport.respondingTimeouts.writeTimeout=0s
           - --entrypoints.websecure.transport.respondingTimeouts.idleTimeout=0s
+          - --ping=true
+          - --ping.entrypoint=health
+          - --entrypoints.health.address=:8082
+          - --entrypoints.web.transport.lifecycle.requestacceptgracetimeout=10s
+          - --entrypoints.web.transport.lifecycle.gracetimeout=300s
+          - --entrypoints.websecure.transport.lifecycle.requestacceptgracetimeout=10s
+          - --entrypoints.websecure.transport.lifecycle.gracetimeout=300s
           - --entrypoints.metrics.address=:9100
           - --metrics.prometheus.entryPoint=metrics
-          image: traefik:v3.3.3
+          image: traefik:v3.3.3@sha256:19884a9d0b922b321c9cff54cbfe43f3169893041b8dd4ea6100677afaddce46
           imagePullPolicy: IfNotPresent
           name: traefik
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: health
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
           ports:
+          - containerPort: 8082
+            name: health
+            protocol: TCP
           - containerPort: 80
             name: web
             protocol: TCP
@@ -67,48 +91,10 @@ items:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
         dnsPolicy: ClusterFirst
+        # Stable NVMe hosts keep ingress away from CI and storage-worker I/O.
         nodeSelector:
-          node-role.kubernetes.io/worker: "true"
+          node-role.kubernetes.io/control-plane: "true"
         affinity:
-          nodeAffinity:
-            requiredDuringSchedulingIgnoredDuringExecution:
-              nodeSelectorTerms:
-              - matchExpressions:
-                - key: hardware
-                  operator: In
-                  values:
-                  - rpi5
-                  - rpi4
-            preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                - key: atlas.bstein.dev/spillover
-                  operator: DoesNotExist
-            - weight: 95
-              preference:
-                matchExpressions:
-                - key: kubernetes.io/hostname
-                  operator: NotIn
-                  values:
-                  - titan-13
-                  - titan-15
-                  - titan-17
-                  - titan-19
-            - weight: 90
-              preference:
-                matchExpressions:
-                - key: hardware
-                  operator: In
-                  values:
-                  - rpi5
-            - weight: 50
-              preference:
-                matchExpressions:
-                - key: hardware
-                  operator: In
-                  values:
-                  - rpi4
           podAntiAffinity:
             requiredDuringSchedulingIgnoredDuringExecution:
             - labelSelector:
@@ -119,6 +105,6 @@ items:
         schedulerName: default-scheduler
         serviceAccount: atlas-traefik-ingress-controller
         serviceAccountName: atlas-traefik-ingress-controller
-        terminationGracePeriodSeconds: 30
+        terminationGracePeriodSeconds: 330
 kind: List
 metadata: {}