--- title: The hidden failure paths that affect Kubernetes control... description: Kubernetes control plane outages can come from mechanisms working as designed, not only from crashes. Three cases illustrate this: an extension API server... canonical: https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The hidden failure paths that affect Kubernetes control plane availability | daily.dev og:description: Kubernetes control plane outages can come from mechanisms working as designed, not only from crashes. Three cases illustrate this: an extension API server... og:url: https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq og:image: https://api.daily.dev/og/posts/qtCV11WBQ.png og:image:alt: The hidden failure paths that affect Kubernetes control plane availability og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The hidden failure paths that affect Kubernetes control plane availability **[The New Stack](https://daily.dev/sources/newstack)** · 13 min read · 0 upvotes · 0 comments ## Summary Kubernetes control plane outages can come from mechanisms working as designed, not only from crashes. Three cases illustrate this: an extension API server published an invalid OpenAPI v2 schema after a dependency upgrade, breaking unrelated Helm deployments because v2 combines all API schemas into one shared document. A DaemonSet rolling restart synchronized thousands of informer list requests, which the API server could not absorb when the watch cache ignored pagination limits. A liveness probe testing KMS reachability caused repeated restarts during a KMS outage, and a composite /healthz check let a failed provider replace an API server with usable cached encryption state. Kubernetes 1.31 corrected API Priority and Fairness list-cost estimation; separating dependency checks from liveness decisions is recommended for health-check design. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did my Helm deployment fail with a schema validation error for a chart that only uses standard Kubernetes resources? An unrelated aggregated API server likely published an invalid OpenAPI v2 schema. Kubernetes' OpenAPI v2 document at /openapi/v2 combines definitions from the core API server and all aggregated extension APIs into one document, so an invalid definition from any extension can break client-side validation for unrelated resources. Helm retrieves this combined v2 document before applying charts, depending on version and settings, making it especially exposed to this failure mode. _Teams debugging Helm validation errors can track Kubernetes API behavior changes like this on daily.dev._ ### Why do my DaemonSet pods overwhelm the Kubernetes API server after a rolling restart? Each DaemonSet pod creates its own informer that lists the full Pod collection on startup, and when many pods restart simultaneously the API server faces a synchronized request storm. Informers often use resourceVersion=0 to read from the watch cache, which for years could ignore the limit parameter and return every matching object, producing responses of tens of thousands of objects and hundreds of megabytes. Kubernetes 1.31 corrected the related API Priority and Fairness list-cost estimation. _Platform engineers tuning DaemonSet recovery behavior can follow Kubernetes control plane fixes like this on daily.dev._ ### Should a liveness probe check an external dependency like a KMS service? No, a liveness probe should test whether the process itself is stuck or unable to serve its local interface, not whether an external dependency is reachable. In one incident, a KMS-integrated encryption provider's liveness probe performed live encrypt and decrypt calls against an external KMS; when the KMS became unreachable, the kubelet kept restarting the provider, which could never reconnect, turning a transient dependency outage into a sustained control plane availability loss. _Engineers designing Kubernetes health checks can weigh dependency-check tradeoffs like these via daily.dev._ ## Similar posts on daily.dev - [How Kubernetes Health Checks Brought Down a Payment Service](https://daily.dev/posts/how-kubernetes-health-checks-brought-down-a-payment-service-jxkwnhtv6) · Medium · 12 upvotes · 0 comments - [Scale isn’t one number: three ways a Kubernetes control plane runs out of room](https://daily.dev/posts/scale-isn-t-one-number-three-ways-a-kubernetes-control-plane-runs-out-of-room-gwo1okyr6) · The New Stack · 0 upvotes · 0 comments - [A Green Kubernetes Deployment Does Not Mean a Healthy Application](https://daily.dev/posts/a-green-kubernetes-deployment-does-not-mean-a-healthy-application-3ohn22rdd) · Cloud Native Now · 1 upvotes · 0 comments - [What 429 chaos experiments taught us about Kubernetes operator resilience](https://daily.dev/posts/what-429-chaos-experiments-taught-us-about-kubernetes-operator-resilience-io2kr0h46) · Red Hat Developer · 3 upvotes · 0 comments - [How Does Kubernetes Self-Healing Work? Understand Self-Healing By Breaking a Real Cluster](https://daily.dev/posts/how-does-kubernetes-self-healing-work-understand-self-healing-by-breaking-a-real-cluster-hsytfe0nv) · freeCodeCamp · 1 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The hidden failure paths that affect Kubernetes control plane availability","url":"https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq"},"datePublished":"2026-10-27T14:04:54.669Z","dateModified":"2026-10-27T14:05:28.186Z","description":"Kubernetes control plane outages can come from mechanisms working as designed, not only from crashes. Three cases illustrate this: an extension API server...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4af39389c8772a05eddd46dc0834198c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4af39389c8772a05eddd46dc0834198c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The New Stack","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The New Stack","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/newstack","url":"https://daily.dev/sources/newstack"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The New Stack","item":"https://daily.dev/sources/newstack"},{"@type":"ListItem","position":3,"name":"The hidden failure paths that affect Kubernetes control plane availability"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-hidden-failure-paths-that-affect-kubernetes-control-plane-availability-qtcv11wbq#faq","mainEntity":[{"@type":"Question","name":"Why did my Helm deployment fail with a schema validation error for a chart that only uses standard Kubernetes resources?","acceptedAnswer":{"@type":"Answer","text":"An unrelated aggregated API server likely published an invalid OpenAPI v2 schema. Kubernetes' OpenAPI v2 document at /openapi/v2 combines definitions from the core API server and all aggregated extension APIs into one document, so an invalid definition from any extension can break client-side validation for unrelated resources. Helm retrieves this combined v2 document before applying charts, depending on version and settings, making it especially exposed to this failure mode. Teams debugging Helm validation errors can track Kubernetes API behavior changes like this on daily.dev."}},{"@type":"Question","name":"Why do my DaemonSet pods overwhelm the Kubernetes API server after a rolling restart?","acceptedAnswer":{"@type":"Answer","text":"Each DaemonSet pod creates its own informer that lists the full Pod collection on startup, and when many pods restart simultaneously the API server faces a synchronized request storm. Informers often use resourceVersion=0 to read from the watch cache, which for years could ignore the limit parameter and return every matching object, producing responses of tens of thousands of objects and hundreds of megabytes. Kubernetes 1.31 corrected the related API Priority and Fairness list-cost estimation. Platform engineers tuning DaemonSet recovery behavior can follow Kubernetes control plane fixes like this on daily.dev."}},{"@type":"Question","name":"Should a liveness probe check an external dependency like a KMS service?","acceptedAnswer":{"@type":"Answer","text":"No, a liveness probe should test whether the process itself is stuck or unable to serve its local interface, not whether an external dependency is reachable. In one incident, a KMS-integrated encryption provider's liveness probe performed live encrypt and decrypt calls against an external KMS; when the KMS became unreachable, the kubelet kept restarting the provider, which could never reconnect, turning a transient dependency outage into a sustained control plane availability loss. Engineers designing Kubernetes health checks can weigh dependency-check tradeoffs like these via daily.dev."}}]} ```