hotrestart

type Config struct {
	// EnvoyPath is the path to the Envoy binary.
	EnvoyPath string
	// ConfigPath is the Envoy bootstrap config (-c). A change to this file (when
	// WatchConfig is set) triggers a hot restart.
	ConfigPath string
	// BaseID is Envoy's --base-id, pinned so successive epochs find the same
	// shared-memory segment. Must be stable for the life of the container.
	BaseID uint32
	// DrainTime maps to Envoy --drain-time-s: how long the draining (old) epoch
	// takes to gracefully close connections.
	DrainTime time.Duration
	// ParentShutdownTime maps to Envoy --parent-shutdown-time-s and gates when the
	// supervisor SIGTERMs the previous epoch. Must exceed DrainTime. It also sets
	// the admin re-verify budget: the epoch-identity probe re-confirms on a fresh
	// connection every ParentShutdownTime/adminReverifyDivisor, so a cross-pod
	// takeover is diagnosed while the draining parent still lives (see
	// adminprobe.go).
	ParentShutdownTime time.Duration
	// ExtraArgs are appended to every Envoy invocation (e.g. -l, --service-cluster,
	// --service-node, --service-zone, --concurrency). A --concurrency that differs
	// from a live predecessor's is not hot-restarted: the predecessor is drained
	// and a fresh lineage started (issue #1136, concurrencychange.go).
	ExtraArgs []string
	// WatchConfig enables an fsnotify watch on ConfigPath's directory that
	// self-triggers a hot restart when the bootstrap config changes (e.g. a
	// ConfigMap update propagated by the kubelet).
	WatchConfig bool
	// StateDir is the shared-hostPath dir holding the per-node epoch heartbeat
	// file. A surging successor pod reads it to start at (live predecessor epoch +
	// 1) and hot-restart across the pod boundary. Required.
	StateDir string
	// ReadyMarkerPath is the pod-local readiness marker the supervisor keeps
	// present only while the node's Envoy admin reports LIVE at this supervisor's
	// newest epoch. An exec readiness probe checks the marker so the DaemonSet
	// keeps the old pod until the new one has taken over. Required.
	ReadyMarkerPath string
	// AdminAddress is the Envoy admin host:port used for the readiness check.
	// The supervisor probes it two ways: /ready on a pooled connection for the
	// per-second liveness watchdog, and /server_info on a fresh connection
	// whenever the answer must identify the epoch (see adminprobe.go).
	AdminAddress string
	// HandoffDeadline overrides defaultHandoffDeadline (0 = default). It is
	// measured from the successor's fork or from its admin's last answer at its
	// own epoch, whichever is later (issue #1085): a successor still answering
	// is waiting on xDS, not wedged. Must be comfortably larger than the
	// successor's worst-case admin silence while it loads its first batch.
	HandoffDeadline time.Duration
	// AdminUnresponsiveDeadline overrides defaultAdminUnresponsiveDeadline
	// (0 = default).
	AdminUnresponsiveDeadline time.Duration
	// TerminationGrace is this pod's terminationGracePeriodSeconds, i.e. how
	// long after SIGTERM the kubelet SIGKILLs the container. The supervisor
	// cannot read it from the API, so the chart passes its own value. It bounds
	// the mid-handoff wait for a successor so a termination with no possible
	// successor still drains Envoy (see successorWaitBudget, issue #771).
	// 0 = unknown: wait indefinitely, the pre-#771 behavior.
	TerminationGrace time.Duration
	// ShutdownDrainImmediately skips the bounded wait for a surge successor on
	// SIGTERM and drains Envoy's listeners straight away (issue #795). It is an
	// escape hatch for a deployment where no replacement can overlap this pod —
	// a DaemonSet without maxSurge, a single-instance proxy — where the wait can
	// only ever burn the grace period before falling back to the same drain.
	//
	// Leave it false wherever a surge replacement exists: the wait is what makes
	// pod delete, node drain, eviction and preemption hitless, because the
	// replacement's Envoy hot-restarts ours instead of finding the node empty.
	ShutdownDrainImmediately bool
	// StallSampleInterval enables the Envoy thread-stall sampler (issue #1093,
	// stallsampler.go) at this sampling interval; 0 disables it.
	StallSampleInterval time.Duration
	// StallThreshold is how long a thread may wait for a CPU, stay blocked, or
	// stay on a CPU within a one-second window before the sampler reports it
	// (0 = DefaultStallThreshold, Envoy's worker watchdog miss threshold).
	StallThreshold time.Duration
	// StallTopConsumers is how many CPU consumers (cgroups, and processes
	// where /proc shows the node's) a [starved] stall line names (#1392,
	// cpuconsumers.go), at most 20. 0 turns the consumer sampling off.
	StallTopConsumers int
	// PodName is this proxy pod's name (optional). It is folded into the
	// per-supervisor admin identity (see adminidentity.go) only so a log line
	// about a FOREIGN Envoy answering the node-shared admin address can name
	// the pod it belongs to; the identity's uniqueness comes from a random
	// nonce, not from this.
	PodName string
	// HotRestartOnConcurrencyChange forces a hot restart from a live
	// predecessor whose Envoy worker count differs from the one the next Envoy
	// would run with. By default (false) such a predecessor is drained and a
	// fresh Envoy lineage started instead, because a hot restart across a
	// worker-count change resets about half of the predecessor's live QUIC
	// connections (issue #1136, concurrencychange.go).
	HotRestartOnConcurrencyChange bool
}

type EnvoyFlag struct {
	// Long is the flag with its two dashes: "--log-level".
	Long string
	// Short is the one-letter spelling with its dash ("-l"), or empty. Envoy
	// counts a short and a long spelling as the same flag.
	Short string
	Kind  EnvoyFlagKind
}

type EnvoyFlagKind int

type Supervisor struct {
	// contains filtered or unexported fields
}

type SupervisorMetrics struct {
	// contains filtered or unexported fields
}

type Telemetry struct {
	// contains filtered or unexported fields
}

type TelemetryConfig struct {
	// OTLPEndpoint is the OTLP gRPC collector metrics are pushed to
	// (host:port, insecure). Required: the supervisor is push-only — it runs
	// outside the controller-runtime manager (no shared Prometheus registry to
	// bridge into) and in the host netns, where a scrape port would collide
	// between surge predecessor and successor pods.
	OTLPEndpoint string
	// ServiceVersion is the build version recorded on the OTel resource.
	ServiceVersion string
}