Kubernetes Weekly: Deployment Timeout Fixes, StatefulSet Bugs, and kuberc Validation

I looked at the last week of commits in kubernetes/kubernetes, around 115 commits and 968 changed files. Three fixes stand out for anyone running workloads: Deployment rollouts now report timeouts even when ReplicaSet scale down fails, a StatefulSet pod name matching bug is fixed, and kubectl gains better validation around credential plugins. There is also solid hardening work in the apiserver storage layer.

Deployment rollouts report timeouts again

The headline fix is the Deployment rollout timeout change, landed via PR #142902. Before this, when scaling down an old ReplicaSet failed, the controller returned the reconcile error and skipped the progress deadline check entirely. The Deployment status would sit there without ever reporting ProgressDeadlineExceeded, so users watching kubectl rollout status saw a stuck rollout with no timeout signal.

The fix adds a syncRolloutStatusAfter helper in pkg/controller/deployment/progress.go that always updates rollout status and aggregates reconcile errors with status errors. The new tests in recreate_test.go cover the cases that previously slipped through:

  • Rollout times out after an old ReplicaSet scale down failure
  • Scale down failure with no new ReplicaSet present
  • Status update error returned alongside the reconcile error

If you have ever debugged a Recreate Deployment that hung for hours past its progressDeadlineSeconds, this is the fix for that.

StatefulSet pod name matching and doc fixes

Two StatefulSet changes landed the same day. The leading zero pod name fix from PR #141094 addresses a subtle matching bug: pod names like stateful-0 versus a ten digit ordinal could be treated as matching when they should not. Worth noting if you parse StatefulSet pod ordinals in your own automation.

On the documentation side, PR #142541 corrects how maxUnavailable percentage rounding is described. The behavior did not change, but if you relied on the doc text to predict rounding, reread it.

kubectl: credential plugin validation and fileKeyRef describe output

PR #142639 adds validation for credential plugin allowlist paths in kuberc. Write side and load side validation were inconsistent, so a config that was accepted on save could fail on load. A follow up commit, the inconsistent write and load validation fix, tightens that further. If you manage kuberc configs across machines, this removes a footgun.

Also useful: PR #142213 makes kubectl describe show env vars sourced through fileKeyRef. Small change, but it closes a visibility gap when debugging pods that pull values from file backed sources.

Storage and apiserver hardening

The busiest area of the week was the apiserver storage layer. The watch cache in staging/src/k8s.io/apiserver/pkg/storage/cacher/ saw six commits, including work to restructure watch processing into two clean stages and to route GuaranteedUpdate and delete paths through cacher.Get. Test infrastructure gained fault injection, so the cacher can now be exercised against failing storage in integration tests. The changes are visible in the cacher source and the correctness test harness.

Two user visible items here:

Build and release infrastructure

Quiet but steady: kube-cross is upgraded to trixie, ginkgo, test, and go-runner are now built as static binaries, and the lint config in hack/golangci.yaml gained stricter checks including the gocritic deprecatedComment rule. Nothing operators need to act on, but it matters for contributors building from source.

What to watch

  • The Deployment and StatefulSet fixes carry release notes, so expect them in the next patch releases of active branches.
  • The cacher refactor is still in flight. More commits around watch handling and storage fault injection are likely.
  • Keep an eye on kuberc validation. More consistency checks around credential plugin allowlists seem probable given the follow up commits.

← All updates