Introduce max pod age to Queue Proxies

[vagababov]

In what area(s)?

/area autoscale
/kind proposal

Describe the feature

We can introduce maxPodAge setting to queue proxies in order for them to commit suicide at some point, to ensure that the end app is built against pod restarts and network connections being broken (e.g. real life).

/cc @mattmoor

[mattmoor]

cc @dgerd @evankanderson

We discussed this during the "v1[beta1] task force", but I eventually moved it out of scope because it isn't part of the API surface (but an internal detail). Generally this is a healthy practice of stateless platforms to ensure folks don't bake in stateful assumptions (e.g. along with minScale). This also forces applications with long-lasting connections to anticipate reconnects, which is also healthy.

One point I made in the task force days was: this actually already exists (indirectly), but with a much longer cycle time. When operators service nodes, pods will be reborn. By tightening the cycle time, we enable folks to discover bad assumptions sooner (hopefully pre-prod).

I believe there are also security benefits to pod rotation.

[dgerd]

I love the idea of adding something like this and think it will be very beneficial to ensure applications are designed in a resilient way and ensure that enough roll-over happens to avoid state creating problems.

That said I also think:

1. We should put this through the feature track process
2. The time should be configurable and include the current behavior as an option
3. This knob feels like another "operator" knob similar to the runtime knob discussed in the last API working group.

[vagababov]

The doc: https://docs.google.com/document/d/1B6saI12pjklRQrZYL2sn9Y7CtDqxkMoBABmEijwPy54/edit#heading=h.n8a530nnrb

[knative-housekeeping-robot]

Issues go stale after 90 days of inactivity.
Mark the issue as fresh by adding the comment /remove-lifecycle stale.
Stale issues rot after an additional 30 days of inactivity and eventually close.
If this issue is safe to close now please do so by adding the comment /close.

Send feedback to Knative Productivity Slack channel or file an issue in knative/test-infra.

/lifecycle stale

[mattmoor]

/remove-lifecycle stale

[vagababov]

Anyone interested in implementing this, btw? I have most of the design complete, but it's not 100% ready :)

[knative-housekeeping-robot]

Issues go stale after 90 days of inactivity.
Mark the issue as fresh by adding the comment /remove-lifecycle stale.
Stale issues rot after an additional 30 days of inactivity and eventually close.
If this issue is safe to close now please do so by adding the comment /close.

Send feedback to Knative Productivity Slack channel or file an issue in knative/test-infra.

/lifecycle stale

[vagababov]

/remove-lifecycle stale
/lifecycle frozen