Thank you both for your replies.
I would love to avoid this, it is completely unnatural behavior. However the application breaks if there is more than one replica, this is a middleware solution (Camunda BPMN engine) that is integrated with a SSO solution using SAML. When we had more than one replica the login authentication would loop infinitely, because it would send requests to multiple pods.
I had implemented a sticky session that worked very well and resolved the problem using nginx ingress controller, however the operations team on my organization now does not want to allow the installation of this nginx ingress controller on higher environments… tst, int, dlt, acc, trn, prd.
I think the only practical solution will be to prevent the Deployment to be scaled, only the service account will be able to do that.
Indeed using Kyverno also works but again the same problem with the operations team. I think I will have to restrict permission to just the service account that does the deployment.
Yes, it is already an assumed risk that when the cluster upgrades there may be downtime. I will try to prevent this by putting in place a PDB.
Public administration organizations are a bit paranoid and cripple all software