Every deploy, a burst of 502s
Rollouts are configured carefully: a new pod has to pass its readiness probe before an old one is removed, and the application handles the termination signal properly by refusing new connections and finishing the ones in flight.
Every rollout still produces a few seconds of errors. The reason is that deleting a pod starts two things at the same time, and neither waits for the other: the proxy is told to stop using the pod, and the pod is told to shut down. If the shutdown wins the race, requests are still arriving at a process that has already stopped accepting them.
Outside every boundary: Old pod (terminating; FAILED: still routed to), New pod (ready), Proxy (routes to pod IPs), Endpoint list (removal in flight; FAILED: not spread yet), Clients, an empty slot for the runs before the signal Connections: Clients calls Proxy — HTTPS runs before the signal controls Old pod — hold, keep serving (step 1) Proxy calls Old pod — still arriving (step 2) Proxy calls New pod — and here (step 3) Endpoint list controls Proxy — the address list