Go's GC doesn't respect cgroup memory limits on its own, risking OOMKill under load; set GOMEMLIMIT to ~90% of each deployment's resources.limits.memory. Also switch imagePullPolicy to Always so :latest tags aren't served stale from node-local cache after a new push.