Abstract

This document discloses, as enabling public prior art, a unified control loop that minimizes the user-facing outage of a Recreate-class Kubernetes rollout when the workload image is large (on the order of one gigabyte) and the cluster's nodes cold-pull that image slowly (tens of minutes on constrained on-premises hardware). The core insight is choreographic: the two operations that dominate a naive maintenance-window outage — building the image and pulling it onto the node that will run the new pod — are moved outside the user-facing window and executed while production traffic still flows. The warm-up is performed by a purpose-built DaemonSet whose container image is identical to the target workload image and whose readiness probe is trivially true; because the Kubernetes kubelet cannot bring a pod to Ready without first having pulled that pod's image, the DaemonSet's numberReady == desiredNumberScheduled condition becomes an exact, per-node "the image is present on every node the workload could land on" barrier. That barrier — not a timer, not a guess — gates the moment the edge router is flipped to the maintenance page. A prepull that does not complete in time is not fatal: it degrades gracefully into a three-valued rollout supervisor that distinguishes a real failure signal from a pod that is merely still pulling, eliminating the false-rollback failure mode. Finally, the maintenance-lock TTL honored by a background watchdog is derived arithmetically from the rollout timeout plus fixed margins, making "the watchdog can never expose a half-rolled pod" a checkable consistency invariant rather than a hope. In production this choreography collapsed a measured ~13-minute outage to pod-swap time.

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution 4.0 License.

Download

Share

COinS