Kubernetes 1.32 In-Place Pod Vertical Resource Scaling Boundary

--- description: Kubernetes 1.32 In-Place Pod Vertical Resource Scaling Boundary - Governs the dynamic patching of container CPU and memory allocations under Kubernetes 1.32 InPlacePodVerticalScaling. Mandates strict resource resize policies, validation of node allocatable headroom, and sequenced memory step-downs to eliminate pod eviction, container restarts, and kernel out-of-memory (OOM) kills. globs: deployments/**/*.yaml, k8s/**/*.yaml, helm/**/*.yaml, src/controllers/**/*.ts, src/services/k8s/**/*.ts alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/k8s-132-inplace-pod-resource-scaling-boundary" --- # Kubernetes 1.32 In-Place Pod Vertical Resource Scaling Boundary > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Patching pod container resources without restartPolicy controls and node capacity pre-checks, triggering node overcommit and silent pod restarts ## System Constraints You are a Principal DevOps and Reliability Engineer enforcing Kubernetes 1.32 In-Place Pod Vertical Resource Scaling boundaries. You mandate strict enforcement of resizePolicy declarations, runtime status verification (allocatedResources vs actual resources), and safe step-down sequences for memory to prevent cgroup OOM kills and accidental pod recycles. ## Strict Guidelines - Engineers MUST explicitly define 'resizePolicy' for both 'cpu' and 'memory' on every container in Pod templates supporting in-place scaling. - Engineers MUST set 'restartPolicy: NotRequired' for resources intended to scale dynamically; 'RestartContainer' MUST NOT be used for latency-critical stateful workloads. - Engineers MUST query and evaluate 'pod.status.resize' and 'pod.status.containerStatuses[].allocatedResources' before dispatching subsequent resource updates. - Engineers MUST NOT attempt to decrease memory limits below the current working set size ('container_memory_working_set_bytes') reported by cgroups or metrics endpoints. - Services MUST execute a two-phase commit when decreasing resources: reduce application heap allocation prior to issuing a Kubernetes Pod resize patch. - Controllers MUST verify node allocatable capacity and existing node reserved resources before issuing scale-up operations to avoid 'Infeasible' resize states. ## Bad vs Good Implementations ### Safe In-Place Vertical Pod Autoscaling Manifest and Patch Controller #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Omits the explicit `resizePolicy` block in pod specifications, causing the kubelet to fall back to default container restart behaviors. Fails to verify whether the pod is currently processing another resize operation (`status.resize`) or check if the target memory limit is lower than the active resident memory, causing instant kernel OOM kills. ```typescript import * as k8s from '@kubernetes/client-node'; // ANTI-PATTERN: Blindly patching resources without resizePolicy or allocatable inspection export async function resizePodResources(k8sApi: k8s.CoreV1Api, name: string, namespace: string, newMemory: string, newCpu: string): Promise<void> { const patch = { spec: { containers: [{ name: 'app', resources: { limits: { memory: newMemory, cpu: newCpu }, requests: { memory: newMemory, cpu: newCpu } } }] } }; // Missing resizePolicy results in container restart or node eviction if memory drops below current consumption await k8sApi.patchNamespacedPod({ name, namespace, body: patch, }); } ``` #### Production Standard (Correct) > **Standard**: Verifies that the target container explicitly declares `restartPolicy: NotRequired` for CPU and memory, validates that a prior resize is not `InProgress`, and guarantees that requested memory scaling remains higher than the active working set size before dispatching the patch. ```typescript import * as k8s from '@kubernetes/client-node'; interface ResourceSpec { cpu: string; memory: string; } export async function resizePodInPlace( k8sApi: k8s.CoreV1Api, name: string, namespace: string, containerName: string, newResources: ResourceSpec, currentWorkingSetBytes: number ): Promise<void> { const pod = await k8sApi.readNamespacedPod({ name, namespace }); const container = pod.spec?.containers.find(c => c.name === containerName); if (!container) throw new Error(`Container ${containerName} not found`); // Invariant 1: Ensure container explicitly supports in-place resource scaling const policies = container.resizePolicy || []; const memPolicy = policies.find(p => p.resourceName === 'memory')?.restartPolicy; const cpuPolicy = policies.find(p => p.resourceName === 'cpu')?.restartPolicy; if (memPolicy !== 'NotRequired' || cpuPolicy !== 'NotRequired') { throw new Error(`Container ${containerName} does not permit in-place scaling without restarts`); } // Invariant 2: Avoid concurrent resize race condition const statusResize = pod.status?.resize; if (statusResize === 'InProgress') { throw new Error(`Resize operation currently InProgress for pod ${name}`); } // Invariant 3: Guard against cgroup OOM kill when scaling down memory const targetBytes = parseResourceToBytes(newResources.memory); if (targetBytes < currentWorkingSetBytes) { throw new Error(`Refusing to scale memory to ${targetBytes}B below active working set ${currentWorkingSetBytes}B`); } const patch = { spec: { containers: [{ name: containerName, resources: { requests: { cpu: newResources.cpu, memory: newResources.memory }, limits: { cpu: newResources.cpu, memory: newResources.memory } } }] } }; await k8sApi.patchNamespacedPod({ name, namespace, body: patch }); } function parseResourceToBytes(mem: string): number { const units: Record<string, number> = { Ki: 1024, Mi: 1024 ** 2, Gi: 1024 ** 3 }; const match = mem.match(/^(\d+)(Ki|Mi|Gi)$/); if (!match) return parseInt(mem, 10); return parseInt(match[1], 10) * units[match[2]]; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kubernetes 1.32 In-Place Pod Vertical Resource Scaling Boundary

Kubernetes 1.32 In-Place Pod Vertical Resource Scaling Boundary defines an industrial-grade behavioral standard for devops engineering. Governs the dynamic patching of container CPU and memory allocations under Kubernetes 1.32 InPlacePodVerticalScaling. Mandates strict resource resize policies, validation of node allocatable headroom, and sequenced memory step-downs to eliminate pod eviction, container restarts, and kernel out-of-memory (OOM) kills. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Patching pod container resources without restartPolicy controls and node capacity pre-checks, triggering node overcommit and silent pod restarts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Patching pod container resources without restartPolicy controls and node capacity pre-checks, triggering node overcommit and silent pod restarts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST explicitly define 'resizePolicy' for both 'cpu' and 'memory' on every container in Pod templates supporting in-place scaling.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.