Kubernetes In-Place Pod Vertical Scaling and cgroup v2 Resizing Invariant

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Patching Pod resource limits without NotRequired resize policies and active memory headroom checks, causing container restarts and OOM kills) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

--- description: Kubernetes In-Place Pod Vertical Scaling and cgroup v2 Resizing Invariant - Enforces deterministic in-place pod vertical scaling patterns without triggering container restarts, cgroup freeze stalls, or sudden OOM kills under cgroup v2. Mandates explicit container resize policies, status-aware transition checks, and strict validation against active memory working sets. globs: deployments/**/*.yaml, k8s/**/*.yaml, src/**/*.{ts,js}, helm/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/kubernetes-inplace-pod-resizing-cgroupv2-invariant" --- # Kubernetes In-Place Pod Vertical Scaling and cgroup v2 Resizing Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Patching Pod resource limits without NotRequired resize policies and active memory headroom checks, causing container restarts and OOM kills ## System Constraints You are a Principal Infrastructure and Kubernetes Platform Architect enforcing the Kubernetes In-Place Pod Vertical Resource Resizing cgroup v2 Invariant. You must guarantee that any vertical scaling automation, controllers, or pod specifications implement non-disruptive resource mutation: explicitly configure resizePolicy, handle cgroup v2 memory thresholds (memory.high vs memory.max), and evaluate status.resize before re-patching. ## Strict Guidelines - Engineers MUST ALWAYS configure `spec.containers[*].resizePolicy` with `restartPolicy: NotRequired` for both `cpu` and `memory` to prevent the kubelet from restarting the container upon resource updates. - Engineers MUST NOT attempt to resize memory limits below the container's current working set size (`container_memory_working_set_bytes` / cgroup v2 `memory.current`), as lowering `memory.max` below active usage triggers immediate kernel OOM killer invocation. - Automation services MUST verify `status.resize` is not already `InProgress` or `Deferred` before applying a new resource patch to a target pod. - Patch operations MUST target `spec.containers[*].resources` and evaluate `status.containerStatuses[*].allocatedResources` to confirm the kubelet has committed the cgroup controller limits. - Workload manifests SHOULD decouple memory request resizing from limit resizing, utilizing a safety delta to account for cgroup v2 buffer cache reclaim latencies. ## Bad vs Good Implementations ### Safe In-Place Vertical Pod Scaling Controller (TypeScript) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This implementation blindsides the container runtime: if the pod template lacks `resizePolicy: NotRequired`, kubelet restarts the container. If target memory is below active `memory.current`, cgroup v2 instantly invokes OOM kill. Furthermore, re-patching while a resize is `InProgress` or `Deferred` triggers API thrashing and race conditions. ```typescript import * as k8s from '@kubernetes/client-node'; // ANTI-PATTERN: Blindly patches pod resources without checking resizePolicy, current usage, or resize status export async function resizePodResources( k8sApi: k8s.CoreV1Api, namespace: string, podName: string, containerName: string, newCpu: string, newMemory: string ): Promise<void> { // Flaw 1: Direct patch without validating status.resize state // Flaw 2: Omits cgroup v2 working set checks, risking instantaneous OOM kill // Flaw 3: Does not verify if the container has restartPolicy: NotRequired const patch = { spec: { containers: [ { name: containerName, resources: { limits: { cpu: newCpu, memory: newMemory }, requests: { cpu: newCpu, memory: newMemory } } } ] } }; const options = { headers: { 'Content-Type': 'application/strategic-merge-patch+json' } }; await k8sApi.patchNamespacedPod(podName, namespace, patch, undefined, undefined, undefined, undefined, undefined, options); } ``` #### Production Standard (Correct) > **Standard**: The production implementation enforces the cgroup v2 invariant: it validates the container spec for `restartPolicy: NotRequired`, prevents concurrent patches during `InProgress` / `Deferred` statuses, and verifies target memory against the cgroup v2 active working set with a buffer margin to prevent kernel OOM thrashing. ```typescript import * as k8s from '@kubernetes/client-node'; interface ResizeParams { containerName: string; targetCpu: string; targetMemoryBytes: bigint; currentWorkingSetBytes: bigint; } export async function resizePodInPlaceSafely( k8sApi: k8s.CoreV1Api, namespace: string, podName: string, params: ResizeParams ): Promise<void> { const { body: pod } = await k8sApi.readNamespacedPod(podName, namespace); const container = pod.spec?.containers.find((c) => c.name === params.containerName); if (!container) { throw new Error(`Container ${params.containerName} not found in pod ${podName}`); } // Invariant 1: Ensure container explicitly supports in-place resizing const memoryPolicy = container.resizePolicy?.find((p) => p.resourceName === 'memory'); const cpuPolicy = container.resizePolicy?.find((p) => p.resourceName === 'cpu'); if (memoryPolicy?.restartPolicy !== 'NotRequired' || cpuPolicy?.restartPolicy !== 'NotRequired') { throw new Error(`Pod ${podName} container ${params.containerName} does not have NotRequired resizePolicy`); } // Invariant 2: Block resizing if a previous resize operation is incomplete if (pod.status?.resize === 'InProgress' || pod.status?.resize === 'Deferred') { throw new Error(`Resize operation already pending (status.resize: ${pod.status.resize})`); } // Invariant 3: Guard cgroup v2 memory invariants - cannot set memory limit below active working set + headroom const MIN_SAFETY_MARGIN_BYTES = BigInt(64 * 1024 * 1024); // 64MiB headroom if (params.targetMemoryBytes < (params.currentWorkingSetBytes + MIN_SAFETY_MARGIN_BYTES)) { throw new Error( `Target memory (${params.targetMemoryBytes}) is below active working set (${params.currentWorkingSetBytes}) plus safety margin` ); } const patch = { spec: { containers: [ { name: params.containerName, resources: { limits: { cpu: params.targetCpu, memory: `${params.targetMemoryBytes}` }, requests: { cpu: params.targetCpu, memory: `${params.targetMemoryBytes}` } } } ] } }; const options = { headers: { 'Content-Type': 'application/strategic-merge-patch+json' } }; await k8sApi.patchNamespacedPod(podName, namespace, patch, undefined, undefined, undefined, undefined, undefined, options); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kubernetes In-Place Pod Vertical Scaling and cgroup v2 Resizing Invariant

Kubernetes In-Place Pod Vertical Scaling and cgroup v2 Resizing Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces deterministic in-place pod vertical scaling patterns without triggering container restarts, cgroup freeze stalls, or sudden OOM kills under cgroup v2. Mandates explicit container resize policies, status-aware transition checks, and strict validation against active memory working sets. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Patching Pod resource limits without NotRequired resize policies and active memory headroom checks, causing container restarts and OOM kills Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Patching Pod resource limits without NotRequired resize policies and active memory headroom checks, causing container restarts and OOM kills	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure `spec.containers[*].resizePolicy` with `restartPolicy

Engineers MUST ALWAYS configure `spec.containers[*].resizePolicy` with `restartPolicy: NotRequired` for both `cpu` and `memory` to prevent the kubelet from restarting the container upon resource updates.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.