From cf8c740b1b546b623545eb157facd15d3f4bc224 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Mon, 14 Sep 2026 23:01:23 +0200
Subject: [PATCH] Switch receiver rollout to Recreate and pin bounded-readyz
 image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RollingUpdate maxSurge cannot schedule a second 50m pod on a node
packed to 99% CPU requests. Recreate replaces in place; the Service
already has no ready endpoints.

Image sha256:ec15f63d… is commit bc3d80f. Local release check passed
against disposable Postgres. No schema migration. Live Ready still
depends on a fresh runtime lease from ESO/OpenBao.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
---
 deploy/README.md                              |  2 +-
 deploy/audit-core.yaml                        | 10 ++---
 deploy/migrate-job.yaml                       |  2 +-
 .../2026-09-14-readyz-receiver-release.json   | 40 +++++++++++++++++++
 4 files changed, 47 insertions(+), 7 deletions(-)
 create mode 100644 docs/evidence/2026-09-14-readyz-receiver-release.json

diff --git a/deploy/README.md b/deploy/README.md
index 81b9e75..e9264fc 100644
--- a/deploy/README.md
+++ b/deploy/README.md
@@ -8,7 +8,7 @@ the server port or export a copy before applying.
 Apply order is documented in `docs/operator-runbook.md`. Do not apply the
 Deployment until:
 
-1. The image digest is pinned (currently `sha256:c2fe39a0…` from commit `abd22fa`).
+1. The image digest is pinned (currently `sha256:ec15f63d…` from commit `bc3d80f`).
 2. Secrets `audit-core-database`, `audit-core-database-migrate`, and
    `audit-core-senders` exist. ConfigMap `audit-core-senders-scope` is
    applied (`deploy/senders-scope.yaml`) before the Deployment mounts it.
diff --git a/deploy/audit-core.yaml b/deploy/audit-core.yaml
index 18a003b..b38ea49 100644
--- a/deploy/audit-core.yaml
+++ b/deploy/audit-core.yaml
@@ -55,10 +55,10 @@ spec:
   replicas: 1
   revisionHistoryLimit: 5
   strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-      maxSurge: 1
+    # Recreate, not RollingUpdate: the node is packed to 99% CPU requests, so
+    # maxSurge: 1 cannot schedule a second 50m pod. The Service already has no
+    # ready endpoints, so replacing in place does not add a delivery gap.
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: audit-core
@@ -86,7 +86,7 @@ spec:
         - name: audit-core
           # REPLACE at release time with the built digest. A mutable tag is not
           # an immutable image, and `:latest` must never be the only reference.
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
           imagePullPolicy: IfNotPresent
           ports:
             - name: http
diff --git a/deploy/migrate-job.yaml b/deploy/migrate-job.yaml
index b4f1b47..95df935 100644
--- a/deploy/migrate-job.yaml
+++ b/deploy/migrate-job.yaml
@@ -33,7 +33,7 @@ spec:
           type: RuntimeDefault
       containers:
         - name: migrate
-          image: forgejo.coulomb.social/coulomb/audit-core@sha256:c82e0442de0fd181342916ae9cd5d6de41d859e1efda637bd93936c67873afa5
+          image: forgejo.coulomb.social/coulomb/audit-core@sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615
           imagePullPolicy: IfNotPresent
           command: ["python", "-m", "audit_core", "migrate"]
           env:
diff --git a/docs/evidence/2026-09-14-readyz-receiver-release.json b/docs/evidence/2026-09-14-readyz-receiver-release.json
new file mode 100644
index 0000000..763b0ca
--- /dev/null
+++ b/docs/evidence/2026-09-14-readyz-receiver-release.json
@@ -0,0 +1,40 @@
+{
+  "image": "forgejo.coulomb.social/coulomb/audit-core:bc3d80f",
+  "native_credentials_used": false,
+  "checks": {
+    "operational_ready": true,
+    "nonroot_readonly": true,
+    "approval-engine": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "informed-decision": {
+      "accepted": 202,
+      "duplicate": 200,
+      "wrong_source": 400,
+      "wrong_tenant": 400,
+      "read_routes_denied": 7,
+      "independent_read": 200,
+      "redacted": true,
+      "stored_once": true
+    },
+    "sigterm": {
+      "exit_code": 0,
+      "inflight_committed_once": true,
+      "restart_retry_duplicate": true,
+      "chain_intact": true
+    }
+  },
+  "started_at": "2026-09-14T20:59:17.605971+00:00",
+  "status": "passed",
+  "own_fixture_cleanup": true,
+  "source_commit": "bc3d80fbd9a23e987d0b775cffcf9d388fc94aa4",
+  "registry_digest": "sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615",
+  "strategy": "Recreate"
+}