From 2b232c4cd2b1f42b1ec3de4b0066ee02e3e36355 Mon Sep 17 00:00:00 2001
From: panxiao81 <pan-xiao@live.cn>
Date: Sun, 20 Sep 2026 21:04:45 +0000
Subject: [PATCH] =?UTF-8?q?=E4=BD=BF=E7=94=A8=E6=97=A0=E9=87=8D=E5=8F=A0?=
 =?UTF-8?q?=E6=BB=9A=E5=8A=A8=E7=AD=96=E7=95=A5=E9=83=A8=E7=BD=B2=20schedu?=
 =?UTF-8?q?ler?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 platform/dynamic-runner/README.md       | 3 ++-
 platform/dynamic-runner/deployment.yaml | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/platform/dynamic-runner/README.md b/platform/dynamic-runner/README.md
index d2ad9e3..695335a 100644
--- a/platform/dynamic-runner/README.md
+++ b/platform/dynamic-runner/README.md
@@ -22,7 +22,8 @@ OpenSandbox chart 所有权边界。
 
 ## Canary 安全边界
 
-- Deployment 为单副本 `Recreate`，避免两个 scheduler 共享同一个 Gitea runner 身份。
+- Deployment 为单副本，滚动策略固定 `maxSurge: 0`、`maxUnavailable: 1`，避免两个
+  scheduler 共享同一个 Gitea runner 身份。
 - controller 的 single-flight gate 只允许一个已领取 task 运行；Gitea 接受终态
   `UpdateTask` 后才领取下一条。`POD_CAPACITY=1` 同时限制 worker 创建并发。
 - executor 镜像使用 digest；Pod 以 UID 2000 运行，SPIRE `ClusterStaticEntry` 同时绑定
diff --git a/platform/dynamic-runner/deployment.yaml b/platform/dynamic-runner/deployment.yaml
index 266dc2b..5aa997c 100644
--- a/platform/dynamic-runner/deployment.yaml
+++ b/platform/dynamic-runner/deployment.yaml
@@ -6,8 +6,10 @@ metadata:
 spec:
   replicas: 1
   strategy:
-    type: Recreate
-    rollingUpdate: null
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 0
+      maxUnavailable: 1
   selector:
     matchLabels:
       app.kubernetes.io/name: dynamic-runner-controller