- imagePullPolicy: Always so :latest actually tracks upstream (nodes were
running two different cached digests)
- --retries 1: supervisor retries forever; this caps the jittered backoff
at ~2s instead of the exponential 1..32s ramp
- liveness failureThreshold 30: let cloudflared's own fast retry loop
reconnect instead of killing pods into exponential CrashLoopBackOff
(pods had 300+ restarts)
- maxSurge 0 / maxUnavailable 1: required anti-affinity on 3 workers
deadlocked surge-based rollouts
- securityContext for restricted:latest PodSecurity (nonroot 65532,
drop ALL caps, no privilege escalation, RuntimeDefault seccomp)
Co-Authored-By: Claude <noreply@anthropic.com>
