This epic accepts the concerns raised in both RFE-6211 and RFE-8819 and addresses WRKLDS-1490 which asks all PDB maintainers to adopt the unhealthyPodEvictionPolicy property (GA in Kubernetes 1.31 / OpenShift 4.18).

We implement this by:

• Setting unhealthyPodEvictionPolicy=AlwaysAllow for all PodDisruptionBudgets managed by the HostedControlPlane operator as the default choice.
• Introducing better probes for the oauth-apiserver and openshift-apiserver to ensure pods are correctly reported as unhealthy when they are not contributing to service availability.

Epic Acceptance Criteria

• All PodDisruptionBudgets managed by the HostedControlPlane operator set unhealthyPodEvictionPolicy to AlwaysAllow when the management cluster supports the field
• Better probes are in place for the oauth-apiserver and openshift-apiserver
• No regressions in hosted control-plane availability

Scope

In Scope

• Setting unhealthyPodEvictionPolicy on PDBs managed by the HostedControlPlane controller
• Improving probes for the oauth-apiserver and openshift-apiserver
• Unit and e2e test coverage

Out of Scope

• PDBs managed by other operators or controllers (covered by WRKLDS-1490)
• Changes to PDB minAvailable/maxUnavailable values

Background

• Kubernetes blog: Unhealthy Pod Eviction Policy for PDBs
• KEP-3017: Pod Healthy Policy for PDB