# Prepare intervention for a stalled Kubernetes StatefulSet rollout

> Ordered readiness can protect sequencing while also preventing automatic progress past a bad revision.

- Canonical URL: https://update.dsesecurity.com/updates/prepare-intervention-for-a-stalled-kubernetes-statefulset-rollout/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:53+00:00
- Modified: 2026-10-20T18:34:32+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Ordered readiness can protect sequencing while also preventing automatic progress past a bad revision.

## Potentially affected

Review recovery from a StatefulSet rolling update that stops at a Pod which never becomes Running and Ready.

## DSE recommendation

DSE recommends writing the recovery sequence before updating a stateful service.

## Article

Ordered readiness can protect sequencing while also preventing automatic progress past a bad revision.

## Source facts

Kubernetes StatefulSets use stable Pod identities and support ordered rollout behavior. With the default OrderedReady management policy, a rolling update can enter a broken state requiring manual intervention. The documentation explains that reverting a bad Pod template may also require deleting Pods already attempted with that configuration before the rollout can proceed normally.

Source: [Kubernetes documentation — StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/).

## Applicability

Review recovery from a StatefulSet rolling update that stops at a Pod which never becomes Running and Ready.

## DSE recommendation

DSE recommends writing the recovery sequence before updating a stateful service. Identify the ordinal being changed, the data-compatibility boundary, the accepted predecessor configuration, and the application health signal that allows the next step. A readiness failure should trigger investigation rather than pressure to bypass ordered safety controls. Keep a clear distinction between replacing a Pod and destroying a claim. Have the service owner review any rollback that could encounter data written by the newer application version.

## Verification

On a disposable StatefulSet, observe an intentionally unready revision and the effect of reverting the template. Follow the documented recovery sequence, inspect Pod revisions and readiness, and verify application data through its supported checks. Record the exact intervention required for the installed configuration. Retain the bad and reverted template revisions and the affected ordinal list. Require explicit approval for each intervention in the exercise, and keep persistent-data disposition outside a Pod-replacement instruction.

## Official reference

[Kubernetes documentation — StatefulSets](https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/). Reviewed October 20, 2026.

## Primary reference

- Name: Kubernetes documentation — StatefulSets
- Authority: kubernetes.io
- URL: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Prepare intervention for a stalled Kubernetes StatefulSet rollout,” DSE Security, https://update.dsesecurity.com/updates/prepare-intervention-for-a-stalled-kubernetes-statefulset-rollout/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.