Set unhealthyPodEvictionPolicy=AlwaysAllow on traefik PDB (#76)

By default the PDB rejects evictions of unhealthy pods unless the
budget is already met (IfHealthyBudget). With minAvailable=1 and a
single not-Ready traefik pod, this blocks node drains on broken
pods that aren't even serving traffic. AlwaysAllow lets the eviction
API release pods that are not Ready regardless of the budget, which
is the recommended default for ingress workloads.

Author: DockToFuture

pkg/traefik/deployer.go

@@ -35,6 +35,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/apimachinery/pkg/util/intstr"
 	"k8s.io/apimachinery/pkg/util/yaml"
+	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	"github.com/gardener/gardener-extension-shoot-traefik/pkg/apis/config"
@@ -882,6 +883,7 @@ func (d *Deployer) podDisruptionBudget() *policyv1.PodDisruptionBudget {
 					LabelInstance: DeploymentName,
 				},
 			},
+			UnhealthyPodEvictionPolicy: ptr.To(policyv1.AlwaysAllow),
 		},
 	}
 }