Bug fixes and enhancements across AWS, GCP, and Kubernetes components.

pkg/clouds/pulumi/aws/ecs_fargate.go

@@ -585,6 +585,7 @@ func createEcsFargateCluster(ctx *sdk.Context, stack api.Stack, params pApi.Prov
 		"elasticfilesystem:ClientWrite",
 		"elasticfilesystem:DescribeMountTargets",
 		"elasticfilesystem:DescribeFileSystems",
+		"cloudwatch:PutMetricData",
 	}
 
 	params.Log.Info(ctx.Context(), "adding extra roles %q for lambda %q...", strings.Join(awsCloudExtras.AwsRoles, ","), stack.Name)

pkg/clouds/pulumi/kubernetes/deployment.go

@@ -277,16 +277,40 @@ func toRollingUpdateArgs(update *k8s.RollingUpdate) *v1.RollingUpdateDeploymentA
 }
 
 func toProbeArgs(c *ContainerImage, probe *k8s.CloudRunProbe) *corev1.ProbeArgs {
-	return &corev1.ProbeArgs{
-		TcpSocket: corev1.TCPSocketActionArgs{
-			Port: sdk.String(toPortName(lo.FromPtr(c.Container.MainPort))),
-		},
+	// Determine the port for the probe:
+	// 1. Use probe's HttpGet.Port if specified
+	// 2. Fall back to container's MainPort if available
+	// 3. Fall back to first container port as last resort
+	var probePort int
+	if probe.HttpGet.Port > 0 {
+		probePort = probe.HttpGet.Port
+	} else if c.Container.MainPort != nil && *c.Container.MainPort > 0 {
+		probePort = *c.Container.MainPort
+	} else if len(c.Container.Ports) > 0 {
+		probePort = c.Container.Ports[0]
+	}
+
+	probeArgs := &corev1.ProbeArgs{
 		PeriodSeconds:       sdk.IntPtrFromPtr(lo.If(probe.Interval != nil, lo.ToPtr(int(lo.FromPtr(probe.Interval).Seconds()))).Else(nil)),
 		InitialDelaySeconds: sdk.IntPtrFromPtr(probe.InitialDelaySeconds),
 		FailureThreshold:    sdk.IntPtrFromPtr(probe.FailureThreshold),
 		SuccessThreshold:    sdk.IntPtrFromPtr(probe.SuccessThreshold),
 		TimeoutSeconds:      sdk.IntPtrFromPtr(probe.TimeoutSeconds),
 	}
+
+	// Use HttpGet probe if path is specified, otherwise fall back to TcpSocket
+	if probe.HttpGet.Path != "" {
+		probeArgs.HttpGet = &corev1.HTTPGetActionArgs{
+			Path: sdk.String(probe.HttpGet.Path),
+			Port: sdk.Int(probePort),
+		}
+	} else {
+		probeArgs.TcpSocket = corev1.TCPSocketActionArgs{
+			Port: sdk.String(toPortName(probePort)),
+		}
+	}
+
+	return probeArgs
 }
 
 func toPortName(p int) string {

pkg/util/string.go

@@ -2,6 +2,7 @@ package util
 
 import (
 	"fmt"
+	"hash/fnv"
 	"regexp"
 	"strings"
 )
@@ -37,8 +38,9 @@ func SanitizeGCPServiceAccountName(name string) string {
 	// Improved name truncation to avoid malformed names
 	accountName := sanitizedName
 	if len(sanitizedName) > 28 {
-		// Use a 4-character hash suffix for uniqueness
-		hash := fmt.Sprintf("%04x", len(sanitizedName)+int(sanitizedName[0])+int(sanitizedName[len(sanitizedName)-1]))
+		// Use FNV-1a hash for better uniqueness - the old hash (len + first + last) was too weak
+		// and caused collisions between similar names like sidecar and init proxies
+		hash := fmt.Sprintf("%04x", fnvHash(sanitizedName)&0xFFFF)
 		// Calculate max prefix length to fit: prefix + "-" + hash <= 28
 		maxPrefixLen := 28 - 1 - len(hash) // 28 - 1 (hyphen) - 4 (hash) = 23
 		prefix := sanitizedName[:maxPrefixLen]
@@ -68,8 +70,8 @@ func SanitizeK8sResourceName(name string) string {
 
 	// Truncate if too long (63 character limit)
 	if len(sanitizedName) > 63 {
-		// Use a 4-character hash suffix for uniqueness
-		hash := fmt.Sprintf("%04x", len(sanitizedName)+int(sanitizedName[0])+int(sanitizedName[len(sanitizedName)-1]))
+		// Use FNV-1a hash for better uniqueness - the old hash (len + first + last) was too weak
+		hash := fmt.Sprintf("%04x", fnvHash(sanitizedName)&0xFFFF)
 		// Calculate max prefix length to fit: prefix + "-" + hash <= 63
 		maxPrefixLen := 63 - 1 - len(hash) // 63 - 1 (hyphen) - 4 (hash) = 58
 		prefix := sanitizedName[:maxPrefixLen]
@@ -83,3 +85,11 @@ func SanitizeK8sResourceName(name string) string {
 
 	return sanitizedName
 }
+
+// fnvHash computes a FNV-1a hash of the input string.
+// This provides much better distribution than the simple len+first+last hash.
+func fnvHash(s string) uint32 {
+	h := fnv.New32a()
+	h.Write([]byte(s))
+	return h.Sum32()
+}