Autoscaling Controller · View 23 of 37 · 4 · Runtime
The decision
- Scale-in is a request the workload may refuse, not an instruction. An instance holding a work lease refuses and stays.
- Selection is by lease state first, connection count second — never by instance age or by whatever the provider picks.
- Drain: stop new work, deregister, wait to the 120 s deadline, then terminate. The deadline is per target because the longest legitimate unit of work is per target.
Why a lease and not a timer alone
- A timer is right for interruptible, idempotent, retryable work and wrong for a 20 minute batch item that has no checkpoint.
- A lease lets the workload declare that fact at the moment it matters, and costs the controller one refused removal per interval when it does.
Risks
- A workload that never releases its lease silently pins capacity. Lease age is a monitored signal, and a target whose refusals persist beyond the cooldown is alerted, not forced.
