VPA updater — evicting pods with new requests

The VPA Updater evicts pods with sub-optimal requests. The eviction is PDB-aware; the updater does not violate the workload’s PDB. This lesson walks the updater, the eviction strategy, the PDB-aware eviction, and the failure modes.

The updater

The VPA Updater is a controller that runs in the cluster. It monitors the recommendations from the Recommender and evicts pods that have sub-optimal requests.

flowchart LR
    A[Recommendation] --> B[Updater]
    B --> C[Find pods with sub-optimal requests]
    C --> D[Check PDB]
    D -->|OK| E[Evict pod]
    D -->|violated| F[Skip pod]
    E --> G[New pod with new requests]

The updater evicts one pod at a time; the workload’s availability is protected.

The eviction strategy

The updater evicts pods in priority order:

1. Highest usage spike. Pods with the largest gap between recommended and current requests.
2. Oldest pod. Pods that have been running for the longest time.
3. Newest pod. Pods that have been running the shortest.

The priority is to evict the pods that benefit most from the new requests.

The PDB-aware eviction

The updater checks the PDB before evicting:

Pod: nginx-1-abc
PDB: maxUnavailable: 1
Current unavailable: 0
After eviction: 1

PDB would be: maxUnavailable 0 → 1, OK

The eviction is allowed.

Pod: nginx-1-abc
PDB: maxUnavailable: 1
Current unavailable: 1
After eviction: 2

PDB would be violated. Skip.

The eviction is blocked.

flowchart LR
    A[Evict pod] --> B[Check PDB]
    B -->|OK| C[Eviction proceeds]
    B -->|violated| D[Skip]
    D --> E[Wait for next cycle]

The eviction limits

The updater has limits to prevent too many evictions at once:

spec:
  updatePolicy:
    updateMode: "Auto"
    evictionRequirements:
    - resources:
      - cpu
      - memory
      changeRequirement: TargetHigher
      clusters: 
        - "default"
        - "production"
      selectors:
      - pod:
          matchLabels:
            app: nginx
        container:
          matchLabels:
            name: nginx

The eviction limits are configurable.

The graceful eviction

The eviction is graceful. The pod is terminated with a configurable grace period:

spec:
  updatePolicy:
    updateMode: "Auto"
    evictionRequirements:
    - evictionGracePeriodSeconds: 60

The grace period is the time the pod has to terminate gracefully. After the grace period, the pod is forcefully terminated.

The failure modes

The common failure modes:

Aggressive eviction

VPA: evicting 5 pods in 10 seconds

The updater is too aggressive. The workload’s availability is impacted. The fix is to set the eviction limits.

PDB-blocked eviction

VPA: eviction blocked by PDB for 2 hours

The updater is blocked by the PDB. The workload’s availability is protected, but the VPA cannot update the pods. The fix is to reduce the workload’s replica count temporarily or to relax the PDB.

Pod not evictable

VPA: pod has a PodDisruptionBudget with minAvailable: 100% → cannot evict

The PDB is too restrictive. The VPA cannot evict the pod. The fix is to set maxUnavailable instead of minAvailable: 100%.

flowchart LR
    A[Updater issue] --> B{Type?}
    B -->|Aggressive| C[Set eviction limits]
    B -->|PDB-blocked| D[Reduce replicas or relax PDB]
    B -->|Not evictable| E[Use maxUnavailable]

The throttling

The updater throttles evictions to avoid disrupting the workload:

Default: 1 eviction per 10 seconds

The throttle is the safety net. The updater does not evict multiple pods at once.

The inspect

kubectl describe vpa nginx-vpa

The output shows the recent evictions:

Status:
  Conditions:
    Last Transition Time:  2026-08-16T10:00:00Z
    Status:                True
    Type:                  RecommendationProvided
  Eviction Requirements:
    Container Name:  nginx
    Eviction Tolerance:  100m
    Resources:        cpu, memory
    Last Transition Time:  2026-08-16T10:00:00Z

The output shows the eviction requirements and the last transition time.

Cross-course references

• The HPA course (Part LXXXII) covers the horizontal alternative.
• The Prometheus course covers VPA metrics.
• The Observability course covers VPA monitoring.

Quiz

Production discipline

• Inspect the VPA status. Use kubectl describe vpa to check the updater’s progress.
• Set the PDB correctly. maxUnavailable: 1 is typical; maxUnavailable: 0 is too restrictive.
• Set the eviction limits. Throttle the number of evictions.
• Set the grace period. 60 seconds is typical.
• Test the VPA on staging. Catch the eviction issues before production.
• Document the VPA config. The PDB, the limits, the grace period.

The VPA Updater is the eviction engine. Operating it well is configuring the PDB, the limits, and the grace period.