Tune Rolling Update Max Surge for Capacity

Set maxSurge to 1 and maxUnavailable to 0 so updates add a new pod before removing an old one and capacity never drops.

~15 minkubernetesrolling-updatedeploy

Task

Configure kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' so the cluster enforces the policy at admission time instead of relying on manual review.

When to use this

A developer deploys a pod without kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' and it disrupts a node, causing evictions on a production cluster.

Prerequisites

A Kubernetes cluster with kubectl access
Cluster admin or namespace edit RBAC

Steps

1. Configure kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' in the project configuration file with the recommended defaults.

kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}'

Expected output: The configuration is accepted and kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' runs without errors on the first invocation.

2. Run the check locally to verify kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' produces the expected result before pushing.

pnpm test

Expected output: Local run matches CI behavior; no surprises after push.

3. Add the gate to the CI pipeline so kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' blocks merge on failure.

- name: Run add rolling update max surge
  run: pnpm test

Expected output: Pull requests with failing kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}' are blocked from merging.

Troubleshooting

Problem

The check passes locally but fails in CI

Solution

Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.

Problem

Configuration is rejected with a schema error

Solution

Check the tool version matches the config schema; older versions may not support newer fields.

Limitations

The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
Configuration drift is possible if someone edits settings outside version control.

Enforce at admission

Start by measuring the problem. Set maxSurge to 1 and maxUnavailable to 0 so updates add a new pod before removing an old one and capacity never drops. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run kubectl patch deploy api -p ‘{“spec”:{“strategy”:{“rollingUpdate”:{“maxSurge”:1,“maxUnavailable”:0}}}}’ against the current codebase and inspect the output before wiring it into CI.

kubectl patch deploy api -p '{"spec":{"strategy":{"rollingUpdate":{"maxSurge":1,"maxUnavailable":0}}}}'

Verify the policy

Once the gate is in place, make failures actionable. A failing kubectl patch deploy api -p ‘{“spec”:{“strategy”:{“rollingUpdate”:{“maxSurge”:1,“maxUnavailable”:0}}}}’ should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.