A timed-out kustomize-controller handoff rollout fails the deploy without saying why

[devantler]

🤖 Generated by the Agentic Engineer (interactive Claude Code session)

Evidence

A merge-group production deploy failed in 🔑 Reassert Flux and consumer GHCR pull credential with only this line:

kustomize-controller did not complete the policy handoff restart.

That was run 36118399316, job 108019641482, for #4175, a Dependabot bump that changes no manifests. The queue evicted the PR, and 🩹 Heal Prod ran to restore main.

The script sends the output of kubectl rollout status (and the restart patch's stderr) to a temporary file and never prints it. The log therefore never says whether the new Pod could not be scheduled, could not pull its image, failed readiness, or was held by a disruption budget. The rollout budget is a fixed 2m.

It is rare: of the ~100 merge-group runs of CI since 2026-09-18, this is the only one that failed at this step. That rarity is why each occurrence needs to explain itself. Without the reason, it cannot be told apart from a real regression, and the only recovery is to re-queue on trust.

Who this affects

Every PR that goes through the merge queue. An eviction costs a full deploy cycle plus a heal. Nobody can say whether the next one is the same transient or a real problem.

Expected behaviour

When the handoff rollout (or its restart patch) fails, the job log shows why: the captured rollout status output, plus the controller's Pod conditions and recent events. Only public-safe fields are printed: no node addresses, credentials or secret contents.

Acceptance criteria

• A failed handoff restart or rollout prints the captured kubectl output before returning non-zero.
• It also prints each kustomize-controller Pod's phase, conditions and waiting reasons, plus the most recent events for those Pods.
• A test pins both paths: failure prints the diagnostics, and success prints none of them.
• Whether 2m is the right budget is decided from the first diagnosed occurrence, not guessed now.

Rough size: small.

---

Generated by Claude Code

[devantler]

🤖 Generated by the Agentic Engineer

Second occurrence today: the merge-group deploy for #4177 failed at 13:45Z in 🚀 Deploy to Production with the same single line, kustomize-controller did not complete the policy handoff restart. (run 36140684692, job 108093966540), and the queue evicted it. #4177 changes only the heal workflow, not this step, so it is not the cause. As before, the log gives no reason, which is what this issue fixes. That is two in about four hours, against one in the previous week's ~100 runs.