Kubernetes

If you manage multi-tenant Kubernetes clusters or enforce strict separation between development, staging, and production environments, you likely rely on namespaces as a primary security boundary. It’s a logical, clean model: workloads and users are isolated within their designated namespaces, creating a clear perimeter for access control and network traffic.

Related reading: the 2026 Kubernetes hardening guide.

But what if this boundary is more of a suggestion than a hard wall? The reality is that namespace isolation, as defined by the Kubernetes security model, is a construct built on the correct configuration of several underlying controls. When one of those controls fails—often through misconfigured platform-level tools—the entire boundary can collapse, enabling lateral movement that compromises the security of your entire cluster.

This isn’t a theoretical concern. Recent vulnerabilities, like the one detailed in a discussion on CVE-2026-22039, demonstrate how admission controllers, which are meant to enforce security, can be exploited to bypass namespace isolation entirely. This event isn’t an anomaly; it’s a symptom of a broader pattern where the complexity of the platform layer introduces critical gaps in a core security tenet.

The Illusion of the Hard Boundary

Kubernetes documentation is clear: “Namespaces are a way to divide cluster resources between multiple users.” They are a mechanism for scoping names and organizing objects. However, they are not a security feature by themselves. Isolation is achieved through the combination of:

• RBAC (Role-Based Access Control): Governing who can do what, and where.
• Network Policies: Controlling pod-to-pod communication.
• Admission Controllers: Validating and mutating requests before persistence.
• Resource Quotas & Limit Ranges: Managing resource consumption.

The security boundary exists only when all these layers are correctly configured and aligned. A flaw in any one layer—especially in a cluster-scoped component like an admission controller, a monitoring agent, or a service mesh sidecar injector—can create a bridge between namespaces.

How the Boundary Fails: Real-World Exploit Paths

Let’s examine common failure modes that break namespace isolation, moving from conceptual to concrete.

1. Privileged Admission Controller Exploits

The CVE-2026-22039 discussion highlights a classic case. An admission controller with broad permissions (e.g., cluster-admin or powerful ClusterRole bindings) is deployed to validate resources. If this controller has a vulnerability—such as improperly validating the requesting user or namespace of the mutated object—an attacker could craft a request that tricks the controller into creating or modifying resources in a namespace they should not have access to.

Attack Flow:

1. Attacker has compromised a pod in the tenant-a namespace.
2. They discover a cluster-scoped admission controller (e.g., a policy engine) is vulnerable to a confused deputy attack.
3. They send a malicious payload to the API server that triggers the admission controller.
4. The admission controller, operating with high privileges, is tricked into creating a privileged ServiceAccount or a pod with host network access in the kube-system namespace.
5. Isolation is broken; lateral movement to a critical namespace is achieved.

2. Misconfigured Network Policies (or Their Absence)

By default, Kubernetes networking allows all pods to communicate with each other, regardless of namespace. Without Network Policies, a compromised pod in dev can directly probe and attack pods in production. Even with policies, a single overly permissive rule (e.g., allowing ingress from all namespaces for a debugging port) can create a breach.

3. Over-Permissioned Service Accounts & Pods

ServiceAccounts are namespaced, but the RBAC Roles or ClusterRoles bound to them are not. A common misconfiguration is binding a namespaced ServiceAccount to a powerful ClusterRole. A pod using that ServiceAccount effectively has those cluster-wide privileges, allowing it to read secrets, delete pods, or create bindings in any namespace.

A Framework for Testing Namespace Boundaries

Assuming isolation is dangerous. You must actively test it. Here is a practical framework for platform and security teams.

Phase 1: Discovery & Mapping

• Inventory Cluster-Scoped Components: List all deployments, daemonsets, and pods in kube-system, gatekeeper-system, istio-system, etc. Document their assigned ServiceAccounts and associated RBAC.
• Audit RBAC Bindings: Use kubectl get clusterrolebindings -o wide and kubectl get rolebindings --all-namespaces to find any bindings of powerful roles to ServiceAccounts or users in non-critical namespaces.
• Map Network Policies: Generate a visual or logical map of allowed ingress/egress flows between namespaces. Identify namespaces with no policies applied.

Phase 2: Active Penetration Testing

From the perspective of a compromised pod in a non-privileged namespace (simulate with a benign test pod), run controlled tests.

Test for Privilege Escalation:

# Inside the test pod
# 1. Check the pod's own permissions
kubectl auth can-i --list

# 2. Attempt to list resources in other namespaces
kubectl get pods -n kube-system
kubectl get secrets -n production

# 3. Attempt to create a pod in another namespace
cat <<EOF | kubectl apply -f - --namespace=kube-system
apiVersion: v1
kind: Pod
metadata:
  name: test-breakout
spec:
  containers:
  - name: busybox
    image: busybox
    command: ['sh', '-c', 'sleep 3600']
EOF

Test for Network Access:

# Use netcat or curl to probe internal services in other namespaces
# Find the ClusterIP of a service in the target namespace
kubectl get svc -n production --output=wide

# From test pod, attempt to connect
curl -v http://<production-service-cluster-ip>:<port>
nc -zv <production-service-cluster-ip> <port>

Phase 3: Admission Controller Stress Testing

This is more advanced but critical. Craft resource manifests designed to probe the logic of your policy engines (e.g., OPA Gatekeeper, Kyverno, custom webhooks).

• Submit requests with mismatched or spoofed namespace fields in the object metadata versus the request path.
• Attempt to create objects that reference resources (like ConfigMaps or Secrets) in other namespaces.
• Test if controllers correctly validate the userInfo (username, groups) of the requester in their decision-making logic.

Hardening the Boundary: Defensive Controls

Testing reveals gaps; these controls close them.

1. Implement Zero-Trust Networking

Default-deny is the only sane starting point. Apply a baseline NetworkPolicy to every namespace that denies all ingress from other namespaces.

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-cross-namespace
  namespace: <protected-namespace>
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector: {} # Only allow from pods in the SAME namespace

Explicitly allow required cross-namespace communication (e.g., from monitoring or service mesh namespaces) using namespaceSelector rules, not open CIDR blocks.

2. Principle of Least Privilege for Platform Tools

Scrutinize the RBAC for every cluster-scoped component. Does your admission controller really need create permission on pods cluster-wide? Or can its role be scoped to specific namespaces or resource types? Use tools like kubectl audit or third-party RBAC analyzers to find and reduce over-permissive bindings.

3. Namespace-as-a-Boundary for ServiceAccounts

Never bind a namespaced ServiceAccount to a ClusterRole unless it is absolutely necessary. If a component needs to act in multiple namespaces, create separate ServiceAccounts and RoleBindings in each namespace, or use a tightly scoped ClusterRole that only lists the required namespaced resources.

Monitoring for Boundary Violations

Detection is your last line of defense. Monitor the Kubernetes API audit logs for tell-tale signs of boundary crossing.

• Unauthorized Cross-Namespace API Calls: Alert on create, update, or get requests where the requesting user/service account’s namespace differs from the target object’s namespace, and the action is not explicitly allowed by a known pattern (e.g., cluster-admin, system components).
• Network Policy Violation Attempts: If using a CNI that supports it (like Cilium), export flow logs and alert on denied connection attempts from one namespace to a sensitive another.
• Admission Controller Anomalies: Monitor the logs of your admission webhooks for a high rate of denials or errors, which could indicate probing or exploit attempts.

Frequently Asked Questions

Conclusion: Isolation as an Active Discipline

Namespace isolation in Kubernetes is not a static configuration you set and forget. It is a dynamic security property that must be continuously validated, enforced, and monitored. The platform’s complexity and extensibility, while powerful, are the very factors that introduce fragility into this boundary.

The deprecation of a component like Ingress-NGINX teaches us to build frameworks for change. Similarly, breaches of namespace isolation teach us that security is not a feature of a single object (the namespace), but an emergent property of the entire system’s configuration. Your cluster’s security boundary is only as strong as the weakest link in the chain of RBAC, network policies, and admission control. Treat it as a critical, living part of your platform—one that demands proactive testing, rigorous hardening, and vigilant observation.

If you’re running containerized workloads at scale, you’ve likely encountered the cold-start problem: a pod gets scheduled, the container runtime begins pulling a multi-gigabyte image, and your application sits idle while layers download. This latency directly impacts developer velocity, autoscaling responsiveness, and user experience.

Related reading: daemonless image tooling with Skopeo, Crane and regctl.

Containerd’s lazy-pulling feature (also known as on-demand pulling or stargz) promises to solve this by fetching only the metadata initially, then downloading individual file chunks as the container accesses them. The promise is compelling—near-instant container startup regardless of image size. However, the community conversation around this feature has been dominated by a misleading metric: pull time.

In this article, we’ll dismantle the pull time benchmark fallacy and examine the real performance characteristics that matter for production workloads. We’ll explore how lazy-pulling actually works under the hood, what metrics you should be measuring instead, and when this technology makes sense for your infrastructure.

How Lazy-Pulling Actually Works in Containerd

Before we can understand the metrics, we need to understand the mechanism. Traditional container image pulling follows a sequential, all-or-nothing approach:

1. The container runtime requests an image manifest.
2. It downloads all layer blobs (compressed tarballs) to local storage.
3. It decompresses and extracts all layers to create the final root filesystem.
4. Only then can the container start.

Lazy-pulling fundamentally changes this workflow. Based on the containerd operations documentation and community implementations, the process looks more like this:

1. The runtime fetches the image manifest and a specialized index file that maps file paths to byte ranges within compressed layers.
2. It prepares a virtual filesystem that appears to contain the complete image.
3. When a process inside the container attempts to read a file, the filesystem driver intercepts the request.
4. It consults the index, fetches only the specific byte ranges needed for that file from the registry, decompresses them on-the-fly, and serves the data to the application.
5. Fetched chunks are cached locally to avoid redundant network requests.

This approach is conceptually similar to how modern game engines stream assets or how HTTP range requests enable video streaming. The key insight is that most containers only need a small subset of their total image content during initial startup.

The Pull Time Fallacy: What Traditional Benchmarks Get Wrong

When lazy-pulling first gained attention, the most common benchmark comparison was simple: “How long does it take to pull a 1GB image versus lazy-pull the same image?” This metric is not just incomplete—it’s actively misleading for several reasons.

1. Pull Time Measures the Wrong Phase

With traditional pulling, the pull command blocks until all layers are downloaded and extracted. With lazy-pulling, the pull command returns almost immediately after fetching metadata. Comparing these two durations is like comparing the time to download a movie trailer versus the time to buffer the entire film—they’re measuring fundamentally different operations.

The meaningful comparison isn’t pull time versus lazy-pull time. It’s total time to application readiness. This includes:

• Metadata fetch time
• Container initialization time
• Application bootstrap time (where file accesses actually happen)
• Any network latency incurred during on-demand fetching

2. It Ignores Workload Access Patterns

As detailed analysis has shown, the performance impact of lazy-pulling depends entirely on your container’s filesystem access patterns during startup. Consider two extreme examples:

• Node.js application: Starts quickly, requires few files (node binary, package.json, a handful of .js files). Lazy-pulling provides near-instant startup.
• Java application with large classpath: Scans hundreds of JAR files during initialization, triggering many small reads across the filesystem. This could result in hundreds of HTTP range requests, adding significant latency.

A single “pull time” metric cannot capture this complexity. The real question is: How does the filesystem access pattern during application startup map to the image’s layer structure?

3. It Misses the Caching Benefit

Traditional pulling has a clear caching model: once a layer is pulled, subsequent containers using that layer start instantly (assuming no registry changes). Lazy-pulling introduces a more nuanced caching model where individual file chunks are cached after first access.

This means the performance of lazy-pulling improves for frequently accessed files across container instances, but benchmarking typically focuses on cold starts only.

The Metrics That Actually Matter for Production

To properly evaluate lazy-pulling for your workloads, you need to measure these key performance indicators:

1. Time-to-First-Byte (TTFB) for Application Requests

This is the most critical metric for user-facing services. How long from kubectl apply or horizontal pod autoscaler decision until your application can serve its first request? This metric encompasses:

• Pod scheduling
• Image provisioning (metadata fetch for lazy-pulling)
• Container runtime initialization
• Application startup (including any on-demand file fetching)
• Health check passes

For autoscaling scenarios, TTFB directly impacts your ability to handle traffic spikes.

2. Application Startup Latency Breakdown

Instead of measuring “pull time,” instrument your application to report key milestones:

# Example instrumentation points for a web application
START_TIME=$(date +%s.%N)
# ... application code ...
CONTAINER_READY=$(date +%s.%N)  # Runtime reports container running
IMPORTS_LOADED=$(date +%s.%N)   # After requiring dependencies
DATABASE_CONNECTED=$(date +%s.%N) # After DB connection established
HTTP_LISTENING=$(date +%s.%N)   # Server listening on port

By comparing these timestamps between traditional and lazy-pulled containers, you can identify exactly where latency is introduced or saved.

3. Network Request Patterns During Startup

Monitor the filesystem layer to understand what’s being fetched:

• How many HTTP range requests occur during startup?
• What’s the total bandwidth transferred versus the full image size?
• What’s the request pattern (sequential vs random access)?
• How effective is the local chunk cache?

This data helps you optimize image construction. If your application sequentially reads every file in /usr/lib during startup, you might want to ensure those files are contiguous in the image layer to minimize range requests.

4. Registry Load and Scaling Characteristics

Lazy-pulling changes the load pattern on your container registry. Instead of occasional large downloads, you get frequent small range requests. You need to measure:

• Registry requests per second during scaling events
• Cache hit ratios at registry CDN level
• Impact on registry authentication systems (more requests = more token validation)

Implementation Considerations and Gotchas

Based on the Kubernetes images documentation and containerd’s implementation, here are practical considerations for adopting lazy-pulling:

Compatibility and Requirements

Lazy-pulling requires specific configuration and compatible images:

• Runtime support: Containerd with appropriate snapshotter (e.g., stargz, overlaybd)
• Image format: Images must be built with lazy-pulling support (e.g., using ctr-remote or nerdctl with stargz compression)
• Registry support: The registry must support HTTP range requests (most do, but verify)
• Kubernetes version: No specific version requirement, but newer kubelets have better integration

When Lazy-Pulling Excels

• Large base images with small applications: e.g., a 2GB ubuntu:latest base running a 50MB Go binary
• Ephemeral workloads: CI/CD runners, batch jobs, function-as-a-service platforms
• Memory-constrained environments: Lazy-pulling avoids decompressing entire layers to disk
• Autoscaling scenarios: When you need to scale from zero quickly

When Traditional Pulling May Be Better

• Applications with random access patterns: Databases that read many files during startup
• Network-limited environments: If each range request has high latency, the overhead adds up
• Air-gapped or registry-constrained deployments: Predictable bandwidth usage may be preferable
• Images with poor locality: Files accessed together aren’t stored together in the image

Practical Recommendations for Platform Teams

1. Profile Before You Optimize

Don’t implement lazy-pulling globally based on synthetic benchmarks. Start with profiling:

1. Identify your most frequently scaled or restarted workloads
2. Measure their actual file access patterns during startup (using strace or eBPF tools)
3. Build test images with lazy-pulling support
4. A/B test against traditional images in staging
5. Measure the real metrics: TTFB, resource usage, registry load

2. Optimize Image Construction

Lazy-pulling performance depends heavily on image layout. Follow these guidelines:

• Place files accessed during startup close together in the layer
• Keep startup dependencies in as few layers as possible
• Consider separating runtime dependencies from build dependencies
• Use multi-stage builds to minimize final image size

3. Implement Gradual Rollout

When deploying lazy-pulling in production:

1. Start with non-critical, ephemeral workloads
2. Implement comprehensive monitoring for both performance and errors
3. Set up alerts for abnormal request patterns to your registry
4. Have a rollback plan (traditional images still available)

4. Monitor the Right Things

Beyond application metrics, monitor infrastructure impacts:

• Registry request rate and latency percentiles
• Node filesystem cache efficiency
• Network bandwidth patterns (many small requests vs few large ones)
• Container startup failure rates

The Future of Container Image Distribution

Lazy-pulling represents a fundamental shift from treating container images as monolithic blobs to treating them as structured, queryable datasets. This evolution will likely continue with:

• Intelligent prefetching: Systems that learn access patterns and prefetch likely-needed chunks
• Content-defined chunking: More efficient than fixed-range requests
• Peer-to-peer distribution: Nodes sharing fetched chunks locally
• Integration with GitOps: Knowing which image versions will be needed based on Git changes

The key takeaway is that we’re moving beyond simple “pull time” optimization toward holistic container lifecycle optimization. The metric that matters isn’t how fast we can download bytes, but how quickly we can deliver working applications to users.

Frequently Asked Questions

Conclusion

Lazy-pulling in containerd v2 is a powerful technology that can dramatically improve container startup performance, but only if measured and implemented correctly. The traditional “pull time” benchmark is a relic of an earlier approach to container images and should be replaced with application-centric metrics like time-to-first-byte and startup latency breakdowns.

For platform engineers and SREs, the path forward is clear: profile your actual workloads, understand their filesystem access patterns, test lazy-pulling with realistic metrics, and implement gradually with proper monitoring. When applied to the right workloads with optimized images, lazy-pulling can transform your scaling responsiveness and resource efficiency.

Remember: the goal isn’t faster image pulls—it’s faster applications. Measure what matters.

If you manage Kubernetes clusters for specialized workloads—think AI/ML, high-performance computing, financial modeling, or real-time data processing—you know that a node being Ready in the Kubernetes sense is often just the starting point. The standard kubelet health checks ensure the node’s core services are running, but they say nothing about whether the specific, often expensive, hardware or software dependencies your workload requires are truly operational.

Related reading: GPU scheduling with Dynamic Resource Allocation.

You might have nodes with GPUs where the driver crashed, nodes with local NVMe volumes that haven’t finished formatting, or nodes where a mandatory security or monitoring agent is unhealthy. Scheduling a sensitive, resource-intensive pod onto such a node is a recipe for silent failures, degraded performance, or security non-compliance.

This is where the Node Readiness Controller moves from a convenience to a critical platform control plane component. While its introductory examples often focus on GPU driver checks, its real power lies in enforcing your platform’s unique definition of “ready.” In this article, we’ll move beyond the basics and explore how to implement custom node readiness gates for advanced, production-grade scenarios.

Why Standard Node Readiness Isn’t Enough

Kubernetes marks a node as Ready when its kubelet can communicate with the API server and reports that essential node conditions (like MemoryPressure, DiskPressure, PIDPressure, and the generic Ready) are false. This is a binary, infrastructure-level view.

For specialized workloads, you need to enforce application-level readiness. Consider these scenarios:

• Local Storage Provisioning: A DaemonSet formats and mounts a local SSD. A pod requiring that fast storage must not schedule until the mount is confirmed writable.
• Kernel Module Dependencies: Your workload needs a specific kernel module (e.g., rdma, nf_conntrack, a custom FPGA driver) loaded and configured. The node is healthy, but the module isn’t present.
• Security & Compliance: Your security policy mandates that a host-based intrusion detection system (HIDS) or a data loss prevention (DLP) agent is running and heartbeating healthily on every node before any workload can run.
• Hardware Attestation: In confidential computing or regulated environments, you may need cryptographic proof from a Trusted Platform Module (TPM) or AMD SEV-SNP that the node’s firmware and boot chain are in a known, trusted state.
• External Resource Availability: The node needs access to a licensed software server, a specific network filesystem, or an external hardware security module (HSM).

Scheduling pods without these conditions met leads to runtime errors, inconsistent performance, or policy violations. The Node Readiness Controller, by adding custom conditions to the node’s status, allows you to define these gates explicitly. The Kubernetes scheduler will then treat a node as unschedulable until all conditions—both built-in and custom—are met.

Architecting Custom Readiness Checks

The pattern involves three key components:

1. The Condition: A custom condition name (e.g., node.alexandre-vazquez.com/LocalStorageReady) you define and add to the node’s .status.conditions.
2. The Checker: A controller or agent running on the node (often as a DaemonSet) that performs the actual validation (e.g., tests a mount, checks a kernel module, calls a health API).
3. The Enforcer: The Node Readiness Controller itself, which watches for these conditions and applies a matching taint (e.g., node.alexandre-vazquez.com/local-storage-not-ready:NoSchedule) when the condition is False or Unknown.

Pods that require the specialized resource must then have a corresponding toleration for that taint. This creates a clean, declarative contract: the pod declares its dependency, and the platform guarantees the node meets the requirement before scheduling.

Practical Implementation: Node-Local Storage Readiness

Let’s implement a common pattern: ensuring a local NVMe volume is formatted, mounted, and performance-tested before allowing pods to claim it via a PersistentVolumeClaim.

First, we define a DaemonSet that runs an init container to prepare the storage and a main container that acts as the readiness checker. The checker will periodically validate the mount and update the node’s condition.

1. DaemonSet for Storage Provisioning and Health Checking

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: local-storage-readiness
  namespace: kube-system
spec:
  selector:
    matchLabels:
      name: local-storage-readiness
  template:
    metadata:
      labels:
        name: local-storage-readiness
    spec:
      hostPID: true
      containers:
      - name: checker
        image: alpine:latest
        command:
        - "/bin/sh"
        args:
        - "-c"
        - |
          # Function to update node condition
          update_condition() {
            local condition=$1
            local status=$2
            local message=$3
            local patch=$(cat <<EOF
            {
              "status": {
                "conditions": [
                  {
                    "type": "$condition",
                    "status": "$status",
                    "lastHeartbeatTime": "$(date -u +'%Y-%m-%dT%H:%M:%SZ')",
                    "reason": "LocalStorageCheck",
                    "message": "$message"
                  }
                ]
              }
            }
            EOF
            )
            curl -k -X PATCH -H "Authorization: Bearer $(cat /var/run/secrets/kubernetes.io/serviceaccount/token)" -H "Content-Type: application/strategic-merge-patch+json" 
              "https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}/api/v1/nodes/$(cat /etc/hostname)/status" -d "$patch"
          }

          # Main check loop
          while true; do
            if mountpoint -q /mnt/local-ssd && [ -w /mnt/local-ssd ] && dd if=/dev/zero of=/mnt/local-ssd/test.bin bs=1M count=100 oflag=direct 2>&1 | grep -q 'records out'; then
              update_condition "LocalStorageReady" "True" "/mnt/local-ssd is writable and performant"
            else
              update_condition "LocalStorageReady" "False" "Local storage failed health check"
            fi
            sleep 30
          done
        securityContext:
          privileged: true
        volumeMounts:
        - name: local-ssd
          mountPath: /mnt/local-ssd
        - name: kube-api-access
          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
          readOnly: true
      initContainers:
      - name: provisioner
        image: alpine:latest
        command: ["sh", "-c"]
        args:
          - mkfs.ext4 -F /dev/nvme0n1 && mkdir -p /mnt/local-ssd && mount /dev/nvme0n1 /mnt/local-ssd
        securityContext:
          privileged: true
        volumeMounts:
        - name: local-ssd
          mountPath: /mnt/local-ssd
        - name: device
          mountPath: /dev/nvme0n1
      volumes:
      - name: local-ssd
        hostPath:
          path: /mnt/local-ssd
          type: DirectoryOrCreate
      - name: device
        hostPath:
          path: /dev/nvme0n1
      - name: kube-api-access
        projected:
          sources:
          - serviceAccountToken:
              expirationSeconds: 3607
              path: token

2. NodeReadinessController Configuration

Now, configure the Node Readiness Controller to watch for our LocalStorageReady condition and apply a taint when it’s not True.

apiVersion: v1
kind: ConfigMap
metadata:
  name: node-readiness-controller-config
  namespace: kube-system
data:
  config.yaml: |
    conditions:
    - name: "LocalStorageReady"
      taint:
        key: "node.alexandre-vazquez.com/local-storage-not-ready"
        effect: "NoSchedule"
      state:
        true: "Ready"  # No taint when condition is True
        false: "NotReady"  # Apply taint when condition is False
        unknown: "NotReady" # Apply taint when condition is Unknown

3. Pod Specification with Toleration

A pod that requires this local storage must tolerate the taint, creating an explicit dependency.

apiVersion: v1
kind: Pod
metadata:
  name: data-processor
spec:
  tolerations:
  - key: "node.alexandre-vazquez.com/local-storage-not-ready"
    operator: "Exists"
    effect: "NoSchedule"
  containers:
  - name: app
    image: my-data-app:latest
    volumeMounts:
    - name: data
      mountPath: /data
  volumes:
  - name: data
    hostPath:
      path: /mnt/local-ssd/pod-data
      type: DirectoryOrCreate

This pattern ensures the pod only schedules onto nodes where the local storage health check has passed. The checker’s simple performance test (dd) helps catch degraded disks that are mounted but failing.

Integrating with Node Feature Discovery and CI/CD

For checks based on hardware capabilities, integrating with Node Feature Discovery (NFD) is powerful. Instead of writing custom hardware detection logic, you can use NFD to label nodes with features (e.g., feature.node.kubernetes.io/cpu-cpuid.AVX512BW: "true"). Your readiness checker can then verify that these expected labels are present and correspond to a working feature.

For example, a checker could:

1. Use NFD labels to identify nodes with specific CPU extensions or GPUs.
2. Run a micro-benchmark or diagnostic (e.g., nvidia-smi --query-gpu=health --format=csv).
3. Set a condition like GpuHealthy to True or False based on the result.

This creates a two-stage validation: NFD discovers the hardware, and your readiness controller certifies its operational health.

CI/CD Pipeline Integration

In a GitOps-driven platform, custom readiness conditions should be treated as first-class citizens. Your deployment pipelines can include steps to verify that target nodes are not only Ready but also meet all custom conditions before proceeding:

# Example pipeline step using kubectl
- name: Validate Node Readiness for Workload
  run: |
    REQUIRED_CONDITIONS=(
      "LocalStorageReady"
      "SecurityAgentReady"
      "FirmwareAttested"
    )
    
    for condition in "${REQUIRED_CONDITIONS[@]}"; do
      if ! kubectl get node $TARGET_NODE -o jsonpath="{.status.conditions[?(@.type=='$condition')].status}" | grep -q "True"; then
        echo "Error: Node $TARGET_NODE not ready. Condition $condition not met."
        exit 1
      fi
    done
    echo "All custom readiness conditions met for $TARGET_NODE."

This proactive check in your CD pipeline can prevent deployments from hanging or failing due to unmet node-level dependencies.

Advanced Use Case: Security Agent Health Gate

Consider a security team that mandates the presence and health of a host-based agent (e.g., Falco, a commercial EDR). A readiness checker DaemonSet can query the agent’s local health API or UNIX socket. If the agent is unresponsive or reports a compromised state, the checker sets a SecurityAgentReady condition to False, tainting the node and preventing any new workloads from scheduling. This hardens your security posture by ensuring no pod runs on a node with a broken security control.

Best Practices and Considerations

• Condition Naming: Use a domain prefix (e.g., yourcompany.com/) to avoid collisions with future Kubernetes built-in conditions.
• Checker Resilience: The checker DaemonSet itself must be highly available and lightweight. Ensure it has appropriate resource requests/limits and a restart policy that maintains the check.
• Taint Effects: Use NoSchedule to prevent new pods. For immediate response to a condition breaking on a running node, you might also consider NoExecute with a tolerationSeconds value on pods, but this requires careful design to avoid unnecessary churn.
• Combining Conditions: A node can have multiple custom conditions. The scheduler respects all of them; a pod will only schedule if it tolerates all the taints applied due to unmet conditions.
• Monitoring and Alerting: Treat custom condition states as critical metrics. Alert your platform team when a False condition persists, indicating a node-level issue requiring investigation.

Frequently Asked Questions

Conclusion

The Node Readiness Controller is a gateway to a more robust, intentional scheduling model. By moving beyond the assumption that a Kubernetes Ready node is ready for your workloads, you can enforce the precise prerequisites your applications demand. Whether it’s certified hardware, validated storage, verified security controls, or licensed software, custom readiness conditions allow your platform to make smarter scheduling decisions.

This shifts the responsibility from the application developer (who must write complex initialization and error-handling logic) to the platform (which guarantees a capable environment). The result is fewer runtime surprises, more consistent performance, and a cluster that truly aligns with your operational and compliance requirements. Start by identifying one critical, non-standard dependency in your most important workloads, and implement a readiness gate for it. The pattern will quickly prove its value across your entire infrastructure.

If you manage production Kubernetes workloads, you’ve likely configured liveness probes. They’re a core Kubernetes feature designed to restart unhealthy containers, a seemingly straightforward mechanism for improving application resilience. Yet, as many seasoned engineers have learned the hard way, this tool can become a weapon of mass destruction against your own cluster’s stability. A misconfigured probe doesn’t just fail to heal an application—it can actively orchestrate its demise through cascading restarts, amplifying a transient issue into a full-blown outage.

Related reading: custom node readiness checks.

Related reading: HPA best practices.

This paradox is well-known in the community. As one engineer succinctly put it on Reddit, liveness probes are a feature that “looked great on paper but turned out to be a footgun” because they can easily “cause cascading failures when they get it wrong.” The problem isn’t the probe itself, but how we implement it. The default mindset of “just add a liveness probe” without deep consideration of application behavior and failure modes is a critical anti-pattern in platform engineering.

In this article, we’ll move beyond the basic documentation and dissect the common liveness probe anti-patterns that undermine system resilience. More importantly, we’ll provide a practical blueprint for designing health checks that act as a true safety net, not a tripwire.

Understanding the Probe Machinery: Liveness vs. Readiness

Before diagnosing anti-patterns, we must clearly distinguish between the two primary health checks. Confusing them is the first and most fundamental mistake.

• Liveness Probe: Answers “Is the container process running?” A failed liveness probe results in the kubelet killing and restarting the container. Its purpose is to recover from a deadlock or a process that is running but unable to make progress.
• Readiness Probe: Answers “Is the container ready to serve traffic?” A failed readiness probe causes the container to be removed from Service endpoints. It does not restart the pod. Its purpose is to handle temporary unavailability during startup, heavy load, or dependency failures.

The critical distinction is consequence: liveness restarts, readiness isolates. Using a liveness probe for a condition that should merely take a pod out of rotation is a guaranteed way to create instability.

Common Liveness Probe Anti-Patterns

These patterns are observed repeatedly in production incidents and post-mortems. Recognizing them is the first step toward remediation.

1. The “Everything is Liveness” Anti-Pattern

This is the most prevalent issue. Engineers point the liveness probe at the same endpoint as the readiness probe, or at a general health check that validates dependencies (databases, caches, message brokers).

Why it’s dangerous: If your database experiences a transient network blip, your liveness probe starts failing. Kubernetes dutifully restarts your pods. Now, instead of a few pods temporarily marked “not ready,” you have all your pods simultaneously crashing and restarting. This creates a thundering herd of new connections when they come back up, often overwhelming the recovering dependency and creating a failure cycle. The minor dependency hiccup has now become a total application outage.

2. The Overly Sensitive (Aggressive) Probe

This involves setting extremely tight timeouts (timeoutSeconds: 1) and short failure thresholds (failureThreshold: 2) on a probe that performs non-trivial work (e.g., a complex database query or an external API call).

Why it’s dangerous: Under normal system load (GC pauses, CPU contention, network latency spikes), the probe may occasionally exceed its strict timeout. Kubernetes interprets this as a failure. A couple of these transient delays in quick succession trigger a restart. You now have perfectly healthy pods being killed because your health check was more fragile than the application logic it was monitoring.

3. The Shared Fate Probe Endpoint

The probe endpoint shares the same thread pool, connection pool, or resource limits as the main application service. Under high load, the health check requests themselves can exhaust these resources, causing the probe to fail and triggering a restart on an overloaded pod—making the load situation worse for the remaining pods.

Why it’s dangerous: It creates a self-reinforcing failure mode. Load increases → probe resources are starved → probes fail → pods restart → load redistributes to fewer pods → load on remaining pods increases further. This cascade can quickly take down the entire service.

4. The Liveness Probe as a Readiness Gate

Using the liveness probe to prevent a pod from receiving traffic until it’s “fully ready,” often by setting an initial delay (initialDelaySeconds) that’s guessed rather than measured.

Why it’s dangerous: If the application takes longer to initialize than the initialDelaySeconds (due to a cold cache, large data load, etc.), the liveness probe will start failing immediately after the delay. The pod will be stuck in a crash loop (CrashLoopBackOff) before it ever had a chance to become ready. The correct tool for this job is the startupProbe.

A Blueprint for Resilient Liveness Probe Design

Designing a robust liveness probe requires a shift in philosophy. The probe should check for unrecoverable process failure, not general health. It should be minimally invasive, highly stable, and tolerant of transient issues.

Principle 1: Liveness Checks Must Be Local and Cheap

The liveness probe should check the state of the process itself, not its external dependencies. It should:

• Run in-memory, without network calls (to other pods or external services).
• Use minimal CPU and no blocking I/O.
• Check an internal flag or a very simple, cached piece of internal state.

A classic example is a thread that updates a “last loop iteration” timestamp in shared memory. The liveness probe checks this timestamp. If it hasn’t been updated in X seconds, the main loop is likely deadlocked, and a restart is justified.

Principle 2: Configure Conservative Timeouts and Thresholds

Your probe configuration should account for the “noisy neighbor” reality of shared infrastructure. Use values that allow for occasional GC pauses and network jitter.

Here is a sample configuration reflecting conservative, production-oriented values:

livenessProbe:
  httpGet:
    path: /internal/health/liveness
    port: 8080
  initialDelaySeconds: 10  # Let the process settle
  periodSeconds: 10        # Don't check too frequently
  timeoutSeconds: 3        # Give it time to respond
  successThreshold: 1
  failureThreshold: 3      # Require multiple consecutive failures

Notice the failureThreshold: 3. A single failed probe means nothing. Two could be a coincidence. Three consecutive failures over 30 seconds is a much stronger signal of a real problem. This grace period can prevent countless unnecessary restarts.

Principle 3: Use the Startup Probe for Lengthy Initialization

For applications with slow boot times (Java VMs, apps loading large models), the startupProbe is your best friend. It disables the liveness and readiness checks until the app is up.

startupProbe:
  httpGet:
    path: /health/startup
    port: 8080
  failureThreshold: 30     # Try many times
  periodSeconds: 5         # Check every 5 seconds
# Liveness probe only starts working AFTER startup succeeds
livenessProbe:
  httpGet:
    path: /internal/health/liveness
    port: 8080
  initialDelaySeconds: 0   # No need for an extra delay
  periodSeconds: 10
  failureThreshold: 3

This configuration allows up to 150 seconds (30 * 5) for the application to start before it’s considered failed, while protecting it from being restarted during that sensitive boot period.

Principle 4: Isolate the Probe Endpoint

Ensure the endpoint used for the liveness probe:

• Has a dedicated, minimal thread pool or runs outside the main request handling framework.
• Is not subject to the same rate limiting or authentication as public APIs.
• Returns a static, pre-computed response or checks only in-memory state.

This isolation ensures that application traffic cannot directly cause a liveness failure.

Putting It All Together: A Resilience-First Strategy

Your health check strategy should be a layered defense:

1. Startup Probe: Guards the initialization phase. Allows slow starts without restarts.
2. Readiness Probe: The primary traffic gatekeeper. Checks app health + critical dependencies. Fails fast and removes the pod from rotation under load or during dependency issues.
3. Liveness Probe: The last resort. Checks only for internal process deadlock. Configured to be slow-triggering (high failureThreshold) and stable.

This strategy ensures that pods are restarted only when there is a high-confidence signal of an unrecoverable internal fault. All other issues—slow dependencies, high load, temporary errors—are handled gracefully by the readiness probe, which isolates the pod without triggering a potentially destabilizing restart.

Frequently Asked Questions

Conclusion: From Footgun to Safety Mechanism

Liveness probes are not a “set and forget” feature. Treating them as such invites the cascading failures that give them a bad reputation. The goal is not to avoid liveness probes, but to implement them with the same care and production rigor as your application code.

By adhering to the blueprint above—keeping checks local and cheap, using conservative thresholds, leveraging startup probes, and isolating endpoints—you transform the liveness probe from a potential source of instability into a genuine resilience mechanism. It becomes a targeted surgical tool for recovering from true process deadlocks, while the readiness probe handles the broader spectrum of application health. In the complex, distributed environment of Kubernetes, this precise separation of concerns is not just a best practice; it’s a fundamental requirement for stable, resilient operations.

Review your probe configurations today. Ask the critical question: “Is this checking for a dead process, or just a busy one?” The answer will determine whether your health checks are preventing outages or causing them.