- Shipped
- September 4, 2026 at 8:42 PM UTC
- Author
- Kamo
- Commit
- cf32e70
preStop sleeps 10s before the process sees SIGTERM. Kubernetes removes the pod from its EndpointSlice and signals it at the same moment, and Traefik only learns of the removal by watch — so for a moment it keeps dispatching new requests into a pod that has already begun refusing them. That gap is where the 502s on an otherwise clean rollout came from. terminationGracePeriodSeconds 5 -> 120: the old value was shorter than the hook, so the hook would have been SIGKILLed before the process drained. It is a ceiling, not a wait. minReadySeconds 15, so a pod that passes readiness once and then falls over cannot retire the healthy pod it replaced after CI has already called the rollout good.