When a pod is deleted, the kubelet sends SIGTERM to the containers and the endpoints controller removes the pod from its EndpointSlice at the same time. These are independent, asynchronous paths. Because kube-proxy and any ingress controller need time to observe the endpoint removal and rewrite their rules, traffic keeps arriving at the pod for a short window after it has already begun shutting down.
The symptom is a small burst of connection-refused or 502 errors on every rollout, proportional to request rate.
The standard mitigation is a preStop hook that simply sleeps, for example five to ten seconds, before the application starts draining. The kubelet runs preStop to completion before sending SIGTERM, which gives the data plane time to converge. terminationGracePeriodSeconds, which defaults to 30, is the total budget covering the preStop hook plus the post-SIGTERM shutdown, so raise it when adding a sleep. After the grace period expires the container receives SIGKILL regardless of state.