Graceful shutdown and draining

Key points

• A rolling deploy kills pods constantly. If shutdown is abrupt, every release shows up to users as a burst of 502s.
• On SIGTERM, Spring Boot can stop accepting new requests and let in-flight ones finish: set server.shutdown: graceful.
• The load balancer needs a moment to notice. A short preStop sleep lets endpoint removal win the race against the JVM stopping.
• Kubernetes waits terminationGracePeriodSeconds and then sends SIGKILL, so that period must exceed your slowest request.
• Consumers need the same care: stop polling, finish the batch in hand, commit the offset, then close the client.

Example

# In the application: stop accepting, then drain.
server:
  shutdown: graceful
spring:
  lifecycle:
    timeout-per-shutdown-phase: 25s     # hard cap on the drain
---
# In the Deployment: give the load balancer time to react first.
apiVersion: apps/v1
kind: Deployment
metadata:
  name: orders
spec:
  template:
    spec:
      terminationGracePeriodSeconds: 40    # must exceed the drain above
      containers:
        - name: app
          image: registry.example.com/orders:1.5.0
          lifecycle:
            preStop:
              exec:
                # Endpoints removal is asynchronous; wait it out.
                command: ["sh", "-c", "sleep 5"]
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            periodSeconds: 2

Leave the rotation first, finish what you already accepted, then exit.