fix(chart): agent DaemonSet updateStrategy maxSurge:1 so a stuck node can't stall the roll (JEF-423)

charts/protector/templates/agent-daemonset.yaml

@@ -26,6 +26,18 @@ metadata:
   labels:
     {{- include "protector.agentLabels" . | nindent 4 }}
 spec:
+  # A stuck node (cordoned, disk-pressure, a wedged kernel that won't unload the old
+  # eBPF probes) must NOT stall the whole roll. The DaemonSet default —
+  # maxUnavailable:1, maxSurge:0 — waits for each node's old pod to terminate before the
+  # next starts, so ONE unkillable pod drops runtime coverage to zero fleet-wide until an
+  # operator intervenes. maxSurge:1 lets a replacement pod come up on healthy nodes
+  # WITHOUT first tearing down the old one, so the roll proceeds past the bad node instead
+  # of blocking on it. Surge (not a higher maxUnavailable) keeps every reachable node
+  # observed throughout the upgrade — coverage never dips below the running fleet.
+  updateStrategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: {{ .Values.agent.maxSurge }}
   selector:
     matchLabels:
       {{- include "protector.agentSelectorLabels" . | nindent 6 }}

charts/protector/values.yaml

@@ -370,6 +370,13 @@ agent:
   #   podAnnotations:
   #     linkerd.io/inject: enabled
   podAnnotations: {}
+  # Rolling-update surge for the DaemonSet. The k8s default (maxUnavailable:1,
+  # maxSurge:0) waits for each node's old pod to terminate before starting the new one,
+  # so a single stuck/cordoned node stalls the whole roll and drops runtime coverage to
+  # zero fleet-wide. maxSurge:1 brings a replacement pod up on healthy nodes without first
+  # tearing down the old one, so the roll proceeds past a bad node — coverage never dips
+  # below the running fleet during an upgrade. Set 0 to restore the default in-place roll.
+  maxSurge: 1
   # RAM-tight for arm64: in-kernel aggregation is cheap; userspace is a thin batcher.
   resources:
     requests: