From be2648cab3be647ccabf279eed0dd662cc464e21 Mon Sep 17 00:00:00 2001
From: gunshiz <spsshop1047@gmail.com>
Date: Fri, 9 Oct 2026 19:20:23 +0700
Subject: [PATCH] fix(deploy) : roll out web replicas without surge capacity

---
 .gitea/workflows/ci.yml           | 4 ++++
 k8s/base/deployment.yaml          | 4 ++--
 tests/deployment-contract.test.ts | 8 ++++++--
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 037fd02..84ddbb2 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -170,6 +170,10 @@ jobs:
           kubectl --kubeconfig "$KUBECONFIG" --namespace "$DEPLOY_NAMESPACE" patch configmap buzz-sheet-config \
             --type=merge \
             --patch "{\"data\":{\"NEXT_DEPLOYMENT_ID\":\"$REVISION\",\"BASE_URL\":\"$BASE_URL\"}}"
+          # Replace one web replica at a time without reserving CPU for a surge pod.
+          kubectl --kubeconfig "$KUBECONFIG" --namespace "$DEPLOY_NAMESPACE" patch deployment buzz-sheet \
+            --type=merge \
+            --patch '{"spec":{"strategy":{"type":"RollingUpdate","rollingUpdate":{"maxSurge":0,"maxUnavailable":1}}}}'
           kubectl --kubeconfig "$KUBECONFIG" --namespace "$DEPLOY_NAMESPACE" set image \
             deployment/buzz-sheet \
             app="$REGISTRY_IMAGE:$REVISION"
diff --git a/k8s/base/deployment.yaml b/k8s/base/deployment.yaml
index 27fd48a..df08c40 100644
--- a/k8s/base/deployment.yaml
+++ b/k8s/base/deployment.yaml
@@ -11,8 +11,8 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
+      maxSurge: 0
+      maxUnavailable: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: buzz-sheet
diff --git a/tests/deployment-contract.test.ts b/tests/deployment-contract.test.ts
index 66175dc..ceaa5e6 100644
--- a/tests/deployment-contract.test.ts
+++ b/tests/deployment-contract.test.ts
@@ -11,8 +11,8 @@ describe("production deployment contract", () => {
     const deployment = await repositoryFile("k8s/base/deployment.yaml");
 
     expect(deployment).toContain("replicas: 2");
-    expect(deployment).toContain("maxSurge: 1");
-    expect(deployment).toContain("maxUnavailable: 0");
+    expect(deployment).toContain("maxSurge: 0");
+    expect(deployment).toContain("maxUnavailable: 1");
     expect(deployment.match(/path: \/api\/healthz\n/gu)).toHaveLength(3);
     expect(deployment).toContain("kubernetes.io/arch: arm64");
     expect(deployment).toMatch(
@@ -144,6 +144,10 @@ describe("production deployment contract", () => {
     );
     expect(workflow).toContain("migrate-$REVISION");
     expect(workflow).toContain("deployment/buzz-sheet-discord-worker");
+    expect(workflow).toContain('"maxSurge":0,"maxUnavailable":1');
+    const patchRolloutStrategy = workflow.indexOf("patch deployment buzz-sheet");
+    expect(patchRolloutStrategy).toBeGreaterThan(-1);
+    expect(patchRolloutStrategy).toBeLessThan(workflow.indexOf("set image"));
     const deleteMigrationJob = workflow.indexOf(
       'delete job buzz-sheet-migrate --ignore-not-found',
     );