[WIP] 🥅 Handle cancellation

.github/workflows/ci.yaml

@@ -10,7 +10,8 @@ permissions:
   contents: read
 
 jobs:
-  build:
+  lint-and-unit-tests:
+    name: Lint & Unit Tests
     runs-on: ubuntu-latest
     timeout-minutes: 15
 
@@ -58,10 +59,62 @@ jobs:
         working-directory: ./plugins/examples/nemocheck
         run: uv run pytest tests
 
-      # Server tests
+      # Server unit tests (no proto generation needed — envoy modules are mocked)
       - name: Install server test dependencies
         run: uv sync --group dev
       - name: Run server unit tests
         run: |
           echo "Running server unit tests..."
-          uv run pytest tests
+          uv run pytest tests/ --ignore=tests/integration
+
+  integration-tests:
+    name: Integration Tests
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    needs: lint-and-unit-tests
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+
+      - name: Set up Python 3.11
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6
+        with:
+          python-version: "3.11"
+
+      - name: Install uv
+        run: pip install uv
+
+      # Cache compiled protobuf files across CI runs
+      - name: Extract proto commit hash
+        id: proto-hash
+        run: |
+          echo "hash=$(grep 'ENVOY_DATA_PLANE_COMMIT=' proto-build.sh | cut -d'"' -f2)" >> "$GITHUB_OUTPUT"
+
+      - name: Cache protobuf files
+        id: proto-cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
+        with:
+          path: |
+            src/envoy
+            src/xds
+            src/validate
+            src/udpa
+          key: protos-${{ steps.proto-hash.outputs.hash }}
+
+      # Build generated protos (gitignored, needed for real envoy imports)
+      - name: Build protobuf files
+        if: steps.proto-cache.outputs.cache-hit != 'true'
+        run: |
+          uv sync --group proto
+          USE_HTTPS=true ./proto-build.sh
+
+      - name: Install test dependencies
+        run: uv sync --group dev
+
+      - name: Run integration tests
+        env:
+          PYTHONPATH: src
+        run: |
+          echo "Running integration tests..."
+          uv run pytest tests/integration/ -v

ext-proc.yaml

@@ -27,6 +27,8 @@ spec:
       labels:
         app: plugins-adapter
     spec:
+      # Allow 35s for graceful shutdown: 5s preStop + 15s gRPC drain + margin
+      terminationGracePeriodSeconds: 35
       securityContext:
         runAsNonRoot: true
         runAsUser: 1000
@@ -67,3 +69,23 @@ spec:
               value: "./"
           ports:
             - containerPort: 50052
+          lifecycle:
+            preStop:
+              exec:
+                # Delay SIGTERM so Envoy/Istio can remove this pod from
+                # its upstream list before we start draining streams.
+                command: ["/bin/sleep", "5"]
+          # gRPC health probes rely on the grpc-health-checking service
+          # registered in serve()
+          readinessProbe:
+            grpc:
+              port: 50052
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            failureThreshold: 3
+          livenessProbe:
+            grpc:
+              port: 50052
+            initialDelaySeconds: 10
+            periodSeconds: 30
+            failureThreshold: 3

pyproject.toml

@@ -6,6 +6,7 @@ requires-python = ">=3.11"
 dependencies = [
     "grpcio>=1.78.0",
     "grpcio-tools>=1.78.0",
+    "grpcio-health-checking>=1.78.0",
     "betterproto2==0.9.1",
     "cpex==0.1.0.dev10",
 ]
@@ -39,6 +40,10 @@ exclude = [
 [tool.ruff.lint]
 select = ["E", "F", "I", "W"]
 
+[tool.ruff.lint.isort]
+known-first-party = ["src", "tests"]
+known-third-party = ["cpex", "envoy", "grpc", "google"]
+
 [tool.pytest.ini_options]
 log_cli = false
 log_cli_level = "INFO"
@@ -49,6 +54,9 @@ log_format = "%(asctime)s [%(module)s] [%(levelname)s] %(message)s"
 log_date_format = "%Y-%m-%d %H:%M:%S"
 testpaths = ["tests"]
 pythonpath = [".", "src"]
+markers = [
+    "integration: integration tests (start real gRPC server)",
+]
 filterwarnings = [
     "ignore::DeprecationWarning",
 ]

tests/pytest.ini → pytest.ini

@@ -6,6 +6,12 @@ log_cli_date_format = %Y-%m-%d %H:%M:%S
 log_level = INFO
 log_format = %(asctime)s [%(module)s] [%(levelname)s] %(message)s
 log_date_format = %Y-%m-%d %H:%M:%S
-pythonpath = . src
+# Paths relative to rootdir (repo root).
+#   tests  = for `from conftest import ...` in unit tests
+#   src    = for generated envoy/xds protos used by integration tests
+pythonpath = tests src
+testpaths = tests
+markers =
+    integration: integration tests (start real gRPC server)
 filterwarnings =
     ignore::DeprecationWarning