Why k8s rolling update didn't stop update when CrashLoopBackOff pods more than maxUnavailable
I don't see readiness probes defined in your manifests. Without readiness probes, Kubernetes will consider a pod to be "ready" as soon as the process is running, and will proceed with terminating other pods during a RollingUpdate.
A failing readiness probe on one pod with maxUnavailable set to 1 should stop the update - but if there is no such probe, there's nothing informing the cluster that pod is not actually ready to accept traffic.