# Self-Healing CI: Recovering a Kubernetes Rollout That Is Briefly Not Ready

> A deploy step that fails because a Kubernetes rollout was not ready in time often just needed longer. See the manual fix and how self-healing CI waits and retries.

Source: https://latchkey.dev/learn/self-healing-ci/self-healing-k8s-rollout-not-ready  
Updated: 2026-06-26

A rollout that has not gone ready by the deadline is usually still converging, not failing -- giving it a moment longer lets the deploy succeed.

## What makes a failure safely retryable

Automatic retry is only correct for failures that are genuinely transient. Retrying a deterministic failure wastes minutes and hides a real defect, so the classification matters more than the retry mechanism.

- Safe to retry: network timeouts, registry 5xx, transient DNS failures, a service container that was not ready, a spot instance reclaimed mid-run.
- Not safe to retry: assertion failures, compile errors, lint violations, anything that fails identically on every attempt.
- Ambiguous, and worth investigating rather than retrying: out-of-memory kills, disk exhaustion, and flaky tests. These repeat under load and a retry only hides the trend.
- Always record that a retry happened. A pipeline that silently retries is a pipeline whose real failure rate you do not know.

## FAQ

### What causes Self-Healing CI: recovering a Kubernetes rollout that is briefly not ready?

A deploy step fails because kubectl rollout status (or an equivalent readiness check) timed out before the new pods became ready. The manifests are valid and the image is fine; image pulls, readiness probes, or scheduling simply took longer than the deadline on this run.

### How do I fix Self-Healing CI: recovering a Kubernetes rollout that is briefly not ready manually?

[object Object]

### Can Self-Healing CI: recovering a Kubernetes rollout that is briefly not ready be fixed automatically?

A "rollout not ready in time" failure is distinguishable from a real rollout failure by whether the deployment converges shortly after the deadline. A self-healing CI pipeline detects the readiness timeout, waits for the rollout to finish converging and re-checks, and only escalates if the rollout genuinely fails to progress, which is

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt