Repository: kubernetes/kubernetes (language: go)

Issue:
Pods with postStart lifecycle hook are stuck in Pending state.
### What happened?

Upon kubernetes control plane v1.32 upgrade pods with **postStart** lifecycle hook configured are unable to start.
Pod is failing to report its state and remains in **Pending** state forever.
Also it's impossible to path or update deployment like change replicas number or image tag, not possible to delete pod without --force flag.
But it allows to update deployment to remove **lifecycle** section.

### What did you expect to happen?

Pod should start normally, lifecycle hook must be processed.

### How can we reproduce it (as minimally and precisely as possible)?

Tested on v1.32.0 (v1.32.0-gke.1448000, v1.32.0-eks-5ca49cb) and v1.32.1 (v1.32.1-gke.1002000)

Create deployment on cluster v1.32, postStart lifecycle hook must be defined as below:
```
lifecycle:
  postStart:
    sleep:
      seconds: 15
```

### Anything else we need to know?

Some details.

1. No issues with PreStop hooks.

2. Deployment definition used to reproduce the issue:

```
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: inflate
  labels:
    app: inflate
automountServiceAccountToken: false


---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: inflate
spec:
  replicas: 1
  selector:
    matchLabels:
      app: inflate
  template:
    metadata:
      labels:
        app: inflate
    spec:
      serviceAccountName: inflate
      containers:
      - args:
          - infinity
        command:
          - sleep
        image: python:3
        name: inflate
        lifecycle:
          postStart:
            sleep:
              seconds: 15
```

3. Error on deployment scaling attempt:
```
$ kubectl scale deployment inflate --replicas 2
Unable to connect to the server: stream error: stream ID 3; INTERNAL_ERROR; received from peer
```

4. Error on editing deployment (image tag change):
```
$ kubectl edit deployments inflate
error: deployments.apps "inflate" could not be patched: Patch "https://<edited>/apis/apps/v1/namespaces/default/deployments/inflate?fieldManager=kubectl-edit&fieldValidation=Strict": stream error: stream ID 5; INTERNAL_ERROR; received from peer
You can run `kubectl replace -f /var/folders/6b/qz1j7hs94kb8j238fb80vf800000gn/T/kubectl-edit-2502749312.yaml` to try this update again.
```

5. Apiserver (EKS) log on similar event:
```
E0129 14:29:50.819453      11 wrap.go:57] "apiserver panic'd" method="PATCH" URI="/apis/apps/v1/namespaces/<edited>/replicasets/<edited>" auditID="d7f993f8-ef27-4544-982d-c8913890fcba"
http2: panic serving 172.16.42.188:34518: runtime error: invalid memory address or nil pointer dereference
goroutine 6006616 [running]:
k8s.io/apiserver/pkg/endpoints/handlers/finisher.finishRequest.func1.1()
	k8s.io/apiserver/pkg/endpoints/handlers/finisher/finisher.go:105 +0xa5
panic({0x3201e40?, 0x5cd2e70?})
	runtime/panic.go:785 +0x132
k8s.io/kubernetes/pkg/api/pod.podLifecycleSleepActionZeroValueInUse.func1(0x0?, 0x0?)
	k8s.io/kubernetes/pkg/api/pod/util.go:775 +0x42
k8s.io/kubernetes/pkg/api/pod.VisitContainers(0xc037a98688, 0x7, 0xc03c12cfe8)
	k8s.io/kubernetes/pkg/api/pod/util.go:73 +0x11e
k8s.io/kubernetes/pkg/api/pod.podLifecycleSleepActionZeroValueInUse(0xc037a61888?)
	k8s.io/kubernetes/pkg/api/pod/util.go:767 +0x3d
k8s.io/kubernetes/pkg/api/pod.GetValidationOptionsFromPodSpecAndMeta(0xc037a98688, 0xc037a61888, 0xc03d1b5a10?, 0xc037a617a0)
	k8s.io/kubernetes/pkg/api/pod/util.go:418 +0x1fe
k8s.io/kubernetes/pkg/api/pod.GetValidationOptionsFromPodTemplate(0x0?, 0xedf170fc1?)
	k8s.io/kubernetes/pkg/api/pod/util.go:551 +0x57
k8s.io/kubernetes/pkg/registry/apps/replicaset.rsStrategy.ValidateUpdate({{0x0?, 0x3773560?}, {0xc037a61688?, 0xc037a98488?}}, {0x3df1580, 0xc041182ab0}, {0x3dcd7d0?, 0xc037a98488}, {0x3dcd7d0, 0xc037a61688})
	k8s.io/kubernetes/pkg/registry/apps/replicaset/strategy.go:146 +0x95
k8s.io/apiserver/pkg/registry/rest.BeforeUpdate({0x3e0a9c0, 0xc006ec32c0}, {0x3df1580, 0xc041182ab0}, {0x3dcd7d0, 0xc037a98488}, {0x3dcd7d0, 0xc037a61688})
	k8s.io/apiserver/pkg/registry/rest/update.go:154 +0x48f
k8s.io/apiserver/pkg/registry/generic/registry.(*Store).Update.func1({0x3dcd7d0, 0xc037a61688}, {0xc037e933b0?, 0x379a6f8?})
	k8s.io/apiserver/pkg/registry/generic/registry/store.go:750 +0x585
k8s.io/apiserver/pkg/storage/etcd3.(*store).updateState(0xc006f86370, 0xc02de24400?, 0x34?)
	k8s.io/apiserver/pkg/storage/etcd3/store.go:1072 +0x3a
k8s.io/apiserver/pkg/storage/etcd3.(*store).GuaranteedUpdate(0xc006f86370, {0x3df1580, 0xc041182ab0}, {0xc037a22b70, 0x2b}, {0x3dcd7d0, 0xc037a61208}, 0x1, 0xc0261e5960, 0xc0377ca370, ...)
	k8s.io/apiserver/pkg/storage/etcd3/store.go:501 +0x985
k8s.io/apiserver/pkg/storage/cacher.(*Cacher).GuaranteedUpdate(0xc006bf6ea0, {0x3df1580, 0xc041182ab0}, {0xc037a22b70, 0x2b}, {0x3dcd7d0, 0xc037a61208}, 0x1, 0xc0261e5960, 0xc0377ca370, ...)
	k8s.io/apiserver/pkg/storage/cacher/cacher.go:981 +0x127
k8s.io/apiserver/pkg/registry/generic/registry.(*DryRunnableStorage).GuaranteedUpdate(0xc034e05d70?, {0x3df1580?, 0xc041182ab0?}, {0xc037a22b70?, 0xb?}, {0x3dcd7d0?, 0xc037a61208?}, 0x50?, 0x2?, 0xc0377ca370, ...)
	k8s.io/apiserver/pkg/registry/generic/registry/dryrun.go:107 +0x177
k8s.io/apiserver/pkg/registry/generic/registry.(*Store).Update(0xc006e9f680, {0x3df1580, 0xc041182ab0}, {0xc0470f861b, 0x18}, {0x3dc55d8, 0xc041182c90}, 0xc037a365f0, 0xc02b0abb80, 0x0, ...)
	k8s.io/apiserver/pkg/registry/generic/registry/store.go:638 +0x415
k8s.io/apiserver/pkg/endpoints/handlers.(*patcher).patchResource.func2()
	k8s.io/apiserver/pkg/endpoints/handlers/patch.go:704 +0xa7
k8s.io/apiserver/pkg/endpoints/handlers.(*patcher).patchResource.func3()
	k8s.io/apiserver/pkg/endpoints/handlers/patch.go:710 +0x35
k8s.io/apiserver/pkg/endpoints/handlers/finisher.finishRequest.func1()
	k8s.io/apiserver/pkg/endpoints/handlers/finisher/finisher.go:117 +0x75
created by k8s.io/apiserver/pkg/endpoints/handlers/finisher.finishRequest in goroutine 6006615
	k8s.io/apiserver/pkg/endpoints/handlers/finisher/finisher.go:92 +0xc8

goroutine 6006615 [running]:
k8s.io/apiserver/pkg/server/filters.(*timeoutHandler).ServeHTTP.func1.1()
	k8s.io/apiserver/pkg/server/filters/timeout.go:110 +0xb0
panic({0x302b360?, 0xc021473740?})
	runtime/panic.go:785 +0x132
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithAudit.func6.1.deferwrap1()
	k8s.io/apiserver/pkg/endpoints/filters/audit.go:84 +0x25
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithAudit.func6.1()
	k8s.io/apiserver/pkg/endpoints/filters/audit.go:93 +0x223
panic({0x302b360?, 0xc021473740?})
	runtime/panic.go:785 +0x132
k8s.io/apiserver/pkg/endpoints/handlers/finisher.(*result).Return(0xc03b913128?)
	k8s.io/apiserver/pkg/endpoints/handlers/finisher/finisher.go:53 +0xad
k8s.io/apiserver/pkg/endpoints/handlers/finisher.finishRequest({0x3df1580, 0xc041182ab0}, 0xc0291b50e0, 0x45d964b800, 0x39a76a0)
	k8s.io/apiserver/pkg/endpoints/handlers/finisher/finisher.go:126 +0x247
k8s.io/apiserver/pkg/endpoints/handlers/finisher.FinishRequest(...)
	k8s.io/apiserver/pkg/endpoints/handlers/finisher/finisher.go:84
k8s.io/apiserver/pkg/endpoints/handlers.(*patcher).patchResource(0xc028766960, {0x3df1580, 0xc041182ab0}, 0xc00788b6c0)
	k8s.io/apiserver/pkg/endpoints/handlers/patch.go:708 +0xa65
k8s.io/apiserver/pkg/endpoints/handlers.PatchResource.func1({0x3de3c30, 0xc0291b5020}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/handlers/patch.go:247 +0x2858
k8s.io/apiserver/pkg/endpoints.(*APIInstaller).registerResourceHandlers.restfulPatchResource.func12(0xc0291b5000, 0xc03a0cca10)
	k8s.io/apiserver/pkg/endpoints/installer.go:1329 +0x6a
k8s.io/apiserver/pkg/endpoints.(*APIInstaller).registerResourceHandlers.InstrumentRouteFunc.func13(0xc0291b5000, 0xc03a0cca10)
	k8s.io/apiserver/pkg/endpoints/metrics/metrics.go:627 +0x1ce
github.com/emicklei/go-restful/v3.(*Container).dispatch(0xc0018578c0, {0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	github.com/emicklei/go-restful/v3@v3.11.0/container.go:299 +0x9d7
github.com/emicklei/go-restful/v3.(*Container).Dispatch(...)
	github.com/emicklei/go-restful/v3@v3.11.0/container.go:204
k8s.io/apiserver/pkg/server.director.ServeHTTP({{0x3784546?, 0x12?}, 0xc0018578c0?, 0xc00193b570?}, {0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/server/handler.go:145 +0x56c
k8s.io/kube-aggregator/pkg/apiserver.(*proxyHandler).ServeHTTP(0xc0098a4c70?, {0x3de3c30?, 0xc0291b4cc0?}, 0x43?)
	k8s.io/kube-aggregator/pkg/apiserver/handler_proxy.go:118 +0x25d
k8s.io/apiserver/pkg/server/mux.(*pathHandler).ServeHTTP(0xc00888dd40, {0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/server/mux/pathrecorder.go:251 +0x410
k8s.io/apiserver/pkg/server/mux.(*PathRecorderMux).ServeHTTP(0xc0470f85f0?, {0x3de3c30?, 0xc0291b4cc0?}, 0x410965?)
	k8s.io/apiserver/pkg/server/mux/pathrecorder.go:237 +0x66
k8s.io/apiserver/pkg/server.director.ServeHTTP({{0x3786997?, 0xc03b9145a0?}, 0xc005f29cb0?, 0xc007a8f260?}, {0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/server/handler.go:153 +0x6f1
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.TrackCompleted.trackCompleted.func22({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:110 +0x162
net/http.HandlerFunc.ServeHTTP(0x3df1580?, {0x3de3c30?, 0xc0291b4cc0?}, 0x4?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filters.withAuthorization.func1({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filters/authorization.go:83 +0x606
net/http.HandlerFunc.ServeHTTP(0xc032d92958?, {0x3de3c30?, 0xc0291b4cc0?}, 0x0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filterlatency.trackStarted.func1({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:84 +0x192
net/http.HandlerFunc.ServeHTTP(0x1dc5fef?, {0x3de3c30?, 0xc0291b4cc0?}, 0x3d9d730?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.TrackCompleted.trackCompleted.func23({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:110 +0x162
net/http.HandlerFunc.ServeHTTP(0xc02b0ab940?, {0x3de3c30?, 0xc0291b4cc0?}, 0x1ec91b0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server/filters.(*priorityAndFairnessHandler).Handle.func10()
	k8s.io/apiserver/pkg/server/filters/priority-and-fairness.go:298 +0xd3
k8s.io/apiserver/pkg/util/flowcontrol.(*configController).Handle.func2()
	k8s.io/apiserver/pkg/util/flowcontrol/apf_filter.go:192 +0x22a
k8s.io/apiserver/pkg/util/flowcontrol/fairqueuing/queueset.(*request).Finish.func1(0xc0377b1680?, 0x70?, 0x35e6de0?)
	k8s.io/apiserver/pkg/util/flowcontrol/fairqueuing/queueset/queueset.go:391 +0x47
k8s.io/apiserver/pkg/util/flowcontrol/fairqueuing/queueset.(*request).Finish(0xc0377b1680, 0xc03a0cc8c0)
	k8s.io/apiserver/pkg/util/flowcontrol/fairqueuing/queueset/queueset.go:392 +0x39
k8s.io/apiserver/pkg/util/flowcontrol.(*configController).Handle(0xc000240640, {0x3df1628, 0xc03a0cc4d0}, {0xc01a7c9790, {0x3df13d8, 0xc02b0ab8c0}}, 0x0?, 0x0?, 0xc02b0ab900?, 0xc02b0ab900)
	k8s.io/apiserver/pkg/util/flowcontrol/apf_filter.go:179 +0x74b
k8s.io/apiserver/pkg/server/filters.(*priorityAndFairnessHandler).Handle.func11(0xc007a33090, {0x3df1580?, 0xc041182660?}, {0xc01a7c9790?, {0x3df13d8?, 0xc02b0ab8c0?}}, 0xc0291b4d20, 0xc0411826f0, 0xc0261e54c0, 0xc02b0ab900)
	k8s.io/apiserver/pkg/server/filters/priority-and-fairness.go:304 +0xeb
k8s.io/apiserver/pkg/server/filters.(*priorityAndFairnessHandler).Handle(0xc007a33090, {0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/server/filters/priority-and-fairness.go:305 +0x9f6
net/http.HandlerFunc.ServeHTTP(0xc032d93100?, {0x3de3c30?, 0xc0291b4cc0?}, 0x0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filterlatency.trackStarted.func1({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:84 +0x192
net/http.HandlerFunc.ServeHTTP(0x1dc5fef?, {0x3de3c30?, 0xc0291b4cc0?}, 0x3d9d730?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.TrackCompleted.trackCompleted.func24({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:110 +0x162
net/http.HandlerFunc.ServeHTTP(0xc0411822d0?, {0x3de3c30?, 0xc0291b4cc0?}, 0xc0470f85fb?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithImpersonation.func4({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filters/impersonation.go:50 +0x1b0
net/http.HandlerFunc.ServeHTTP(0xc032d93680?, {0x3de3c30?, 0xc0291b4cc0?}, 0x0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filterlatency.trackStarted.func1({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:84 +0x192
net/http.HandlerFunc.ServeHTTP(0x1dc5fef?, {0x3de3c30?, 0xc0291b4cc0?}, 0x3d9d730?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.TrackCompleted.trackCompleted.func25({0x3de3c30, 0xc0291b4cc0}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:110 +0x162
net/http.HandlerFunc.ServeHTTP(0xc0012eee60?, {0x3de3c30?, 0xc0291b4cc0?}, 0x3df1580?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithAudit.func6({0x3de3c30, 0xc0291b4c80}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filters/audit.go:115 +0x395
net/http.HandlerFunc.ServeHTTP(0xc032d93a10?, {0x3de3c30?, 0xc0291b4c80?}, 0x0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filterlatency.trackStarted.func1({0x3de3c30, 0xc0291b4c80}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:84 +0x192
net/http.HandlerFunc.ServeHTTP(0x1dc5fef?, {0x3de3c30?, 0xc0291b4c80?}, 0x3d9d730?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.TrackCompleted.trackCompleted.func27({0x3de3c30, 0xc0291b4c80}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:110 +0x162
net/http.HandlerFunc.ServeHTTP(0x3df1580?, {0x3de3c30?, 0xc0291b4c80?}, 0x3d972c0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filters.withAuthentication.func1({0x3de3c30, 0xc0291b4c80}, 0xc037a4b540)
	k8s.io/apiserver/pkg/endpoints/filters/authentication.go:123 +0x7bf
net/http.HandlerFunc.ServeHTTP(0x3df1580?, {0x3de3c30?, 0xc0291b4c80?}, 0x3d9d730?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/endpoints/filterlatency.trackStarted.func1({0x3de3c30, 0xc0291b4c80}, 0xc037a4b180)
	k8s.io/apiserver/pkg/endpoints/filterlatency/filterlatency.go:94 +0x354
net/http.HandlerFunc.ServeHTTP(0xc037a4b040?, {0x3de3c30?, 0xc0291b4c80?}, 0xc037a36500?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithWarningRecorder.func11({0x3de3c30, 0xc0291b4c80}, 0xc037a4b040)
	k8s.io/apiserver/pkg/endpoints/filters/warning.go:35 +0xb9
net/http.HandlerFunc.ServeHTTP(0xc00c621f48?, {0x3de3c30?, 0xc0291b4c80?}, 0xb424ec?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server/filters.(*timeoutHandler).ServeHTTP.func1()
	k8s.io/apiserver/pkg/server/filters/timeout.go:115 +0x5b
created by k8s.io/apiserver/pkg/server/filters.(*timeoutHandler).ServeHTTP in goroutine 6006574
	k8s.io/apiserver/pkg/server/filters/timeout.go:101 +0x198

goroutine 6006574 [running]:
golang.org/x/net/http2.(*serverConn).runHandler.func1()
	golang.org/x/net@v0.30.0/http2/server.go:2432 +0x145
panic({0x302b360?, 0xc021473820?})
	runtime/panic.go:785 +0x132
k8s.io/apimachinery/pkg/util/runtime.handleCrash({0x3df0fa0, 0x5d564c0}, {0x302b360, 0xc021473820}, {0xc0293fca70, 0x1, 0xc03c6a7360?})
	k8s.io/apimachinery/pkg/util/runtime/runtime.go:89 +0xee
k8s.io/apimachinery/pkg/util/runtime.HandleCrash({0xc03c6a73a8, 0x1, 0xc027cb3180?})
	k8s.io/apimachinery/pkg/util/runtime/runtime.go:59 +0x108
panic({0x302b360?, 0xc021473820?})
	runtime/panic.go:785 +0x132
k8s.io/apiserver/pkg/server/filters.(*timeoutHandler).ServeHTTP(0xc0065b6d80, {0x3de3c30, 0xc0291b4c00}, 0xdf8475800?)
	k8s.io/apiserver/pkg/server/filters/timeout.go:121 +0x32f
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithRequestDeadline.withRequestDeadline.func28({0x3de3c30, 0xc0291b4c00}, 0xc037a4adc0)
	k8s.io/apiserver/pkg/endpoints/filters/request_deadline.go:100 +0x234
net/http.HandlerFunc.ServeHTTP(0x3df1580?, {0x3de3c30?, 0xc0291b4c00?}, 0x7f8055d9c5b8?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithWaitGroup.withWaitGroup.func29({0x3de3c30, 0xc0291b4c00}, 0xc037a4adc0)
	k8s.io/apiserver/pkg/server/filters/waitgroup.go:86 +0x17d
net/http.HandlerFunc.ServeHTTP(0xc00178f100?, {0x3de3c30?, 0xc0291b4c00?}, 0x3782b82?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server/filters.(*goaway).ServeHTTP(0xc005daf720, {0x3de3c30, 0xc0291b4c00}, 0xc037a4adc0)
	k8s.io/apiserver/pkg/server/filters/goaway.go:72 +0x142
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithCacheControl.func14({0x3de3c30, 0xc0291b4c00}, 0xc037a4adc0)
	k8s.io/apiserver/pkg/endpoints/filters/cachecontrol.go:31 +0xa7
net/http.HandlerFunc.ServeHTTP(0x1?, {0x3de3c30?, 0xc0291b4c00?}, 0x410965?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithHTTPLogging.WithLogging.withLogging.func35({0x3de3c30, 0xc0291b4c00}, 0xc037a4adc0)
	k8s.io/apiserver/pkg/server/httplog/httplog.go:112 +0x95
net/http.HandlerFunc.ServeHTTP(0x3df1698?, {0x3de3c30?, 0xc0291b4c00?}, 0x30?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithLatencyTrackers.func16({0x3de3ea0, 0xc01b9dfa40}, 0xc037a4ac80)
	k8s.io/apiserver/pkg/endpoints/filters/webhook_duration.go:56 +0x143
net/http.HandlerFunc.ServeHTTP(0xc037a4ab40?, {0x3de3ea0?, 0xc01b9dfa40?}, 0xc037a4ab40?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithRequestInfo.func18({0x3de3ea0, 0xc01b9dfa40}, 0xc037a4ab40)
	k8s.io/apiserver/pkg/endpoints/filters/requestinfo.go:39 +0x119
net/http.HandlerFunc.ServeHTTP(0xc037a4aa00?, {0x3de3ea0?, 0xc01b9dfa40?}, 0xef2dbd6e4f3?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithRequestReceivedTimestamp.withRequestReceivedTimestampWithClock.func32({0x3de3ea0, 0xc01b9dfa40}, 0xc037a4aa00)
	k8s.io/apiserver/pkg/endpoints/filters/request_received_time.go:38 +0xaf
net/http.HandlerFunc.ServeHTTP(0x30?, {0x3de3ea0?, 0xc01b9dfa40?}, 0xc0000a2e08?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithMuxAndDiscoveryComplete.func19({0x3de3ea0?, 0xc01b9dfa40?}, 0xc037a4aa00?)
	k8s.io/apiserver/pkg/endpoints/filters/mux_discovery_complete.go:52 +0xd5
net/http.HandlerFunc.ServeHTTP(0xed50e219a1f68e5c?, {0x3de3ea0?, 0xc01b9dfa40?}, 0x410965?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithPanicRecovery.withPanicRecovery.func33({0x3de3ea0, 0xc01b9dfa40}, 0xc037a4aa00)
	k8s.io/apiserver/pkg/server/filters/wrap.go:73 +0xdc
net/http.HandlerFunc.ServeHTTP(0xc040891200?, {0x3de3ea0?, 0xc01b9dfa40?}, 0xc037a22ab0?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.DefaultBuildHandlerChain.WithAuditInit.withAuditInit.func34({0x3de3ea0, 0xc01b9dfa40}, 0xc0379e2a00)
	k8s.io/apiserver/pkg/endpoints/filters/audit_init.go:63 +0x135
net/http.HandlerFunc.ServeHTTP(0xc0003a4ac0?, {0x3de3ea0?, 0xc01b9dfa40?}, 0xc00043e330?)
	net/http/server.go:2220 +0x29
k8s.io/apiserver/pkg/server.(*APIServerHandler).ServeHTTP(0xc00c621d40?, {0x3de3ea0?, 0xc01b9dfa40?}, 0xc0408fb950?)
	k8s.io/apiserver/pkg/server/handler.go:188 +0x25
net/http.serverHandler.ServeHTTP({0xc0474c3b60?}, {0x3de3ea0?, 0xc01b9dfa40?}, 0x3deb700?)
	net/http/server.go:3210 +0x8e
net/http.initALPNRequest.ServeHTTP({{0x3df1580?, 0xc0321de9c0?}, 0xc03799c388?, {0xc007a94960?}}, {0x3de3ea0, 0xc01b9dfa40}, 0xc0379e2a00)
	net/http/server.go:3819 +0x231
golang.org/x/net/http2.(*serverConn).runHandler(0x4469db?, 0xc032f50260?, 0x3db0780?, 0x5cd2c90?)
	golang.org/x/net@v0.30.0/http2/server.go:2439 +0xf5
created by golang.org/x/net/http2.(*serverConn).scheduleHandler in goroutine 2753346
	golang.org/x/net@v0.30.0/http2/server.go:2373 +0x21d
```

### Kubernetes version

<details>

```console
Client Version: v1.32.1
Kustomize Version: v5.5.0
Server Version: v1.32.0-gke.1448000
```

```console
Client Version: v1.32.1
Kustomize Version: v5.5.0
Server Version: v1.32.1-gke.1002000
```

```console
Client Version: v1.32.1
Kustomize Version: v5.5.0
Server Version: v1.32.0-eks-5ca49cb
```

</details>


### Cloud provider

<details>

AWS, GCP

</details>


### OS version

<details>

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>



Discussion / hints:
There are no sig labels on this issue. Please add an appropriate label by using one of the following commands:
- `/sig <group-name>`
- `/wg <group-name>`
- `/committee <group-name>`

Please see the [group list](https://git.k8s.io/community/sig-list.md) for a listing of the SIGs, working groups, and committees available.


<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>
This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the `triage/accepted` label and provide further guidance.

The `triage/accepted` label can be added by org members by writing `/triage accepted` in a comment.


<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.
</details>

Fix patch:
diff --git a/pkg/api/pod/util.go b/pkg/api/pod/util.go
index a00c82cc08395..06a2573fcd2eb 100644
--- a/pkg/api/pod/util.go
+++ b/pkg/api/pod/util.go
@@ -418,7 +418,7 @@ func GetValidationOptionsFromPodSpecAndMeta(podSpec, oldPodSpec *api.PodSpec, po
 			}
 		}
 
-		opts.AllowPodLifecycleSleepActionZeroValue = opts.AllowPodLifecycleSleepActionZeroValue || podLifecycleSleepActionZeroValueInUse(podSpec)
+		opts.AllowPodLifecycleSleepActionZeroValue = opts.AllowPodLifecycleSleepActionZeroValue || podLifecycleSleepActionZeroValueInUse(oldPodSpec)
 		// If oldPod has resize policy set on the restartable init container, we must allow it
 		opts.AllowSidecarResizePolicy = opts.AllowSidecarResizePolicy || hasRestartableInitContainerResizePolicy(oldPodSpec)
 	}
@@ -775,7 +775,7 @@ func podLifecycleSleepActionZeroValueInUse(podSpec *api.PodSpec) bool {
 			inUse = true
 			return false
 		}
-		if c.Lifecycle.PostStart != nil && c.Lifecycle.PostStart.Sleep != nil && c.Lifecycle.PreStop.Sleep.Seconds == 0 {
+		if c.Lifecycle.PostStart != nil && c.Lifecycle.PostStart.Sleep != nil && c.Lifecycle.PostStart.Sleep.Seconds == 0 {
 			inUse = true
 			return false
 		}


Test patch:
diff --git a/pkg/api/pod/util_test.go b/pkg/api/pod/util_test.go
index 81897f4c48422..42678e29b8b41 100644
--- a/pkg/api/pod/util_test.go
+++ b/pkg/api/pod/util_test.go
@@ -4657,3 +4657,92 @@ func TestValidateInvalidLabelValueInNodeSelectorOption(t *testing.T) {
 		})
 	}
 }
+
+func TestValidateAllowPodLifecycleSleepActionZeroValue(t *testing.T) {
+	testCases := []struct {
+		name                                        string
+		podSpec                                     *api.PodSpec
+		expectAllowPodLifecycleSleepActionZeroValue bool
+	}{
+		{
+			name:    "no lifecycle hooks",
+			podSpec: &api.PodSpec{},
+			expectAllowPodLifecycleSleepActionZeroValue: false,
+		},
+		{
+			name: "Prestop with non-zero second duration",
+			podSpec: &api.PodSpec{
+				Containers: []api.Container{
+					{
+						Lifecycle: &api.Lifecycle{
+							PreStop: &api.LifecycleHandler{
+								Sleep: &api.SleepAction{
+									Seconds: 1,
+								},
+							},
+						},
+					},
+				},
+			},
+			expectAllowPodLifecycleSleepActionZeroValue: false,
+		},
+		{
+			name: "PostStart with non-zero second duration",
+			podSpec: &api.PodSpec{
+				Containers: []api.Container{
+					{
+						Lifecycle: &api.Lifecycle{
+							PostStart: &api.LifecycleHandler{
+								Sleep: &api.SleepAction{
+									Seconds: 1,
+								},
+							},
+						},
+					},
+				},
+			},
+			expectAllowPodLifecycleSleepActionZeroValue: false,
+		},
+		{
+			name: "PreStop with zero seconds",
+			podSpec: &api.PodSpec{
+				Containers: []api.Container{
+					{
+						Lifecycle: &api.Lifecycle{
+							PreStop: &api.LifecycleHandler{
+								Sleep: &api.SleepAction{
+									Seconds: 0,
+								},
+							},
+						},
+					},
+				},
+			},
+			expectAllowPodLifecycleSleepActionZeroValue: true,
+		},
+		{
+			name: "PostStart with zero seconds",
+			podSpec: &api.PodSpec{
+				Containers: []api.Container{
+					{
+						Lifecycle: &api.Lifecycle{
+							PostStart: &api.LifecycleHandler{
+								Sleep: &api.SleepAction{
+									Seconds: 0,
+								},
+							},
+						},
+					},
+				},
+			},
+			expectAllowPodLifecycleSleepActionZeroValue: true,
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			gotOptions := GetValidationOptionsFromPodSpecAndMeta(&api.PodSpec{}, tc.podSpec, nil, nil)
+			assert.Equal(t, tc.expectAllowPodLifecycleSleepActionZeroValue, gotOptions.AllowPodLifecycleSleepActionZeroValue, "AllowPodLifecycleSleepActionZeroValue")
+		})
+	}
+}