Zero-Downtime Deployments in Kubernetes: Container Termination Lifecycles & PreStop Hooks

In continuous delivery environments deploying updates dozens of times per day, client request drops or 502 Bad Gateway spikes during container rescheduling are intolerable. Achieving true zero-downtime rolling updates requires mastering the pod termination lifecycle.

1. The Kubernetes Pod Termination Race Condition

When updating a deployment, Kubernetes executes two actions concurrently:

Dispatches SIGTERM to the container process.
Removes the pod from the Service endpoints list (propagating updates to kube-proxy and iptables across nodes).

The Trap: iptables synchronization takes 1 to 3 seconds. If your application terminates its listening socket immediately upon SIGTERM, in-flight and newly routed requests will be rejected with Connection Refused errors!

k8s_deployment.yaml

spec:
  containers:
  - name: api-server
    image: seang.org/api:v2.2.0
    lifecycle:
      preStop:
        exec:
          # Sleep 5 seconds so kube-proxy removes the pod from endpoints
          # before Go process receives the SIGTERM signal!
          command: ["/bin/sh", "-c", "sleep 5"]
    terminationGracePeriodSeconds: 30