It was previously set to extensions/v1beta1. I have discovered that when the Deployment is created as a extensions/v1beta1, it causes the existing pod to be killed immediately when doing a rolling update. When the Deployment was created as apps/v1, a rolling update behaves as expected: a new pod is created, and the old one is only terminated once the new pod is ready to serve traffic.
The existing Deployment resource will need to be deleted and recreated:
We have performed the migration, downtime was only a few seconds. We have also tried a running update for a non existing Docker image tag. The new pod kept running, a new one was created and failed to pull the image; I reverted the Docker image to the 1.9.0 tag and the failed pod was deleting, leaving the previous one.
While we were at it I removed one of the worker nodes (see #29), first setting an unused node as cordoned, and then downsizing the pool. We are running on two smalls now