A DaemonSet surge update doubles the hostPort bind and the new pods never become Ready on half the nodes

The rollout strategy looks safer on paper, but the host-level port exclusivity means old and new pods cannot overlap.