A ReplicaSet is a Kubernetes workload resource that manages a set of Pods from a Pod template and replica count. Deployments create ReplicaSets behind the scenes, normally hiding this implementation detail. section 12.5.1
During a rolling update, a Deployment uses separate ReplicaSets for the old and new versions, scaling them gradually to replace Pods. section 12.5.1
Find rejected Pods through the ReplicaSet
If a Deployment reports no Pods, inspect its ReplicaSet. Commands such as kubectl get rs and kubectl describe rs can reveal FailedCreate events and admission errors that are not visible on the Deployment itself. section 12.5.1
$ kubectl create -f Chapter03/3.2_DeployingToKubernetes/deploy.yaml deployment.apps/timeserver created $ kubectl get deploy NAME READY UP-TO-DATE AVAILABLE AGE timeserver 0/3 0 0 12s $ kubectl get pods No resources found in myapp namespace. $ kubectl get rs NAME DESIRED CURRENT READY AGE timeserver-5b4fc5bb4 3 0 0 31s $ kubectl describe rs Events: Type Reason Age From Message ---- ------ ---- ---- ------- Warning FailedCreate 36s replicaset-controller Error creating: admission webhook "pod-security-webhook.kubernetes.io" denied the request: pods "timeserver-5b4fc5bb4-hvqcm" is forbidden: violates PodSecurity "restricted:v1.28": allowPrivilegeEscalation != false (container "timeserver-container" must set securityContext.allowPrivilegeEscalation=false), unrestricted capabilities (container "timeserver-container" must set securityContext.capabilities.drop=["ALL"]), runAsNonRoot != true (pod or container "timeserver-container" must set securityContext.runAsNonRoot=true)
Shows a Deployment with zero Pods and the ReplicaSet event containing the rejected-Pod admission error. section 12.5.1
