- Ya
- 4 Septemba 2026, 20:39 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 30da19b
RAGService binds two JetStream durables of its own — rag-note-consumer and rag-kb-consumer — and a durable push consumer with no deliver group admits exactly ONE subscriber. A second pod would have been refused [SUB-90012], leaving the indexing pinned to whichever pod bound first with nothing taking over when that pod is the one that dies. Both now join a deliver group, so NATS hands each event to exactly one pod. That is what indexing needs: once, not once per pod, and not once per pod that happened to win a race. replicas 1 -> 2. This service runs no @Scheduled work and binds no exclusive NATS durable, so a second pod duplicates nothing — it is stateless request serving, and the only thing keeping it at one replica was that nothing had raised the number. At one replica maxSurge hides the exposure during a clean deploy and nowhere else: an OOM kill, a failed liveness probe or a node drain took the capability out entirely for the 59-79 seconds a Spring context takes to boot. A PodDisruptionBudget in KlusterServices now makes a drain wait.