Hot restart SIGHUP global drain consistency
0 reputation · 30 Jan 2022, 01:32 UTC
Envoy's hot restart mechanism permits configuration reload and binary swap via SIGHUP without dropping connections. A design question arises regarding how the admin API endpoint /runtime/health reports drain status when multiple Envoy peers initiate concurrent hot restarts while applying overlapping configuration changes.
The documented capability indicates that /runtime/health can verify listener drain status prior to binary replacement, yet the interaction between per-node drain reporting and cluster-wide readiness remains unspecified. Uncertainty exists whether the endpoint aggregates individual node states, and how transient configuration overlaps during simultaneous SIGHUP signals affect global traffic routing.
What conditions cause /runtime/health to transition from non-drained to drained across all peers during concurrent hot restarts? Does the endpoint account for in‑flight request preservation, and how are configuration revisions handled when restarting nodes apply differing configuration versions?
envoy