[{"data":1,"prerenderedAt":818},["ShallowReactive",2],{"blog-en-k3s-hpa-scaledown-stabilization-window-replica-flapping":3,"blog-related-en-k3s-hpa-scaledown-stabilization-window-replica-flapping":757,"blog-en-k3s-hpa-scaledown-stabilization-window-replica-flapping-alt":745},{"id":4,"title":5,"author":6,"body":7,"date":739,"description":740,"extension":741,"image":742,"locale":743,"meta":744,"navigation":745,"path":746,"seo":747,"stem":748,"tags":749,"__hash__":756},"blog\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping.md","HPA Replica Count Flaps Every Few Minutes. The Root Cause Wasn't Metrics — It Was a Missing scaleDown Stabilization Window","Kubo Team",{"type":8,"value":9,"toc":728},"minimark",[10,15,19,26,50,53,57,76,102,108,114,119,127,131,138,147,157,163,170,174,187,203,222,228,231,235,244,250,594,597,618,630,634,650,653,661,665,671,692,705,724],[11,12,14],"h2",{"id":13},"a-production-k3s-cluster-kept-swinging-its-hpa-replica-count-between-2-and-6-every-5-minutes","A production K3s cluster kept swinging its HPA replica count between 2 and 6 every 5 minutes",[16,17,18],"p",{},"On a production K3s cluster, a workload with HPA (HorizontalPodAutoscaler) enabled started swinging its replica count between 2 and 6 pods every five minutes. Looking at the dashboards, request volume and CPU load were both flat — nothing looked obviously wrong. Yet the replica count kept oscillating like a wave.",[16,20,21],{},[22,23],"img",{"alt":24,"src":25},"section01","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping\u002Fsection01.webp",[16,27,28,29,33,34,37,38,41,42,49],{},"This is a textbook case of \"HPA scaling flap.\" Digging deeper, the metrics pipeline itself was fine — the root cause was that the HPA's ",[30,31,32],"code",{},"behavior"," field had never been explicitly configured. The default ",[30,35,36],{},"scaleUp","\u002F",[30,39,40],{},"scaleDown"," behavior turned out to be more aggressive than expected. If you'd rather not have to build your own dashboard to notice this kind of quirk, ",[43,44,48],"a",{"href":45,"rel":46},"https:\u002F\u002Fkubo.hexabase.io\u002F",[47],"nofollow","Kubo","'s Captain UI visualizes scaling trends out of the box, which shortens the time it takes to spot problems like this.",[16,51,52],{},"This article breaks down the three actual causes we found (asymmetric behavior defaults, a CPU requests denominator problem, and latency from metrics sync intervals) and walks through the concrete fix for a K3s environment.",[11,54,56],{"id":55},"cause-1-the-scaleupscaledown-defaults-are-asymmetric-and-behavior-was-never-configured","Cause 1: The scaleUp\u002FscaleDown defaults are asymmetric, and behavior was never configured",[16,58,59,60,65,66,68,69,71,72,75],{},"According to the ",[43,61,64],{"href":62,"rel":63},"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Fconcepts\u002Fworkloads\u002Fautoscaling\u002Fhorizontal-pod-autoscale\u002F",[47],"Kubernetes official documentation",", HPA's ",[30,67,36],{}," and ",[30,70,40],{}," each have different default stabilization windows (",[30,73,74],{},"stabilizationWindowSeconds",").",[77,78,79,93],"ul",{},[80,81,82,84,85,88,89,92],"li",{},[30,83,36],{},": stabilization window of 0 seconds (instant), ",[30,86,87],{},"selectPolicy"," is ",[30,90,91],{},"Max"," (picks the most aggressive recommendation)",[80,94,95,97,98,88,100],{},[30,96,40],{},": stabilization window of 300 seconds (5 minutes), ",[30,99,87],{},[30,101,91],{},[16,103,104],{},[22,105],{"alt":106,"src":107},"section02","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping\u002Fsection02.webp",[16,109,110,111,113],{},"In other words, the replica count increases the instant load rises, but it doesn't decrease right away when load drops. That much is intentional, \"safety-first\" design. But if you never configure the ",[30,112,32],{}," field and load fluctuates even slightly, scaleUp's \"instant\" reaction keeps overriding scaleDown's \"5-minute wait\" effect, and the replica count gradually starts to oscillate.",[115,116,118],"h3",{"id":117},"what-the-stabilization-window-actually-does","What the stabilization window actually does",[16,120,121,122,126],{},"The stabilization window isn't a simple \"delay timer.\" Per the ",[43,123,125],{"href":62,"rel":124},[47],"official documentation",", it picks the \"most conservative value\" from the recommended replica counts recorded within the window. If the window is too short, there isn't enough history to choose a conservative value from, and the oscillation goes unchecked.",[11,128,130],{"id":129},"cause-2-optimizing-cpu-requests-actually-made-scaling-more-sensitive","Cause 2: \"Optimizing\" CPU requests actually made scaling more sensitive",[16,132,133,134,137],{},"Many teams tighten ",[30,135,136],{},"resources.requests.cpu"," to match real usage as a cost-cutting measure. But this can make HPA flapping worse.",[16,139,140,141,146],{},"This is exactly the \"percentage math problem\" pointed out by the ",[43,142,145],{"href":143,"rel":144},"https:\u002F\u002Fscaleops.com\u002Fblog\u002Fhpas-three-architectural-flaws-and-why-your-autoscaling-keeps-failing\u002F",[47],"ScaleOps blog",". HPA's CPU utilization is calculated as:",[148,149,154],"pre",{"className":150,"code":152,"language":153},[151],"language-text","utilization = current CPU usage ÷ CPU requests × 100\n","text",[30,155,152],{"__ignoreMap":156},"",[16,158,159],{},[22,160],{"alt":161,"src":162},"section03","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping\u002Fsection03.webp",[16,164,165,166,169],{},"Even if actual workload consumption hasn't changed, the moment you optimize ",[30,167,168],{},"requests"," from 200m to 100m, the denominator is cut in half, so apparent utilization jumps from 75% to 150%. HPA misreads this as a sudden spike in load and triggers an unnecessary scale-out. It's a classic case where a cost-saving requests optimization ironically destabilizes scaling.",[11,171,173],{"id":172},"cause-3-the-sync-interval-between-metrics-server-and-hpa-was-stacking-up-latency","Cause 3: The sync interval between metrics-server and HPA was stacking up latency",[16,175,176,177,182,183,186],{},"K3s ",[43,178,181],{"href":179,"rel":180},"https:\u002F\u002Fdocs.k3s.io\u002Finstallation\u002Fpackaged-components",[47],"bundles metrics-server by default",", powering both ",[30,184,185],{},"kubectl top"," and HPA's CPU\u002Fmemory metrics. That's convenient, but it's worth understanding the latency involved.",[16,188,189,190,195,196,199,200,202],{},"Per the ",[43,191,194],{"href":192,"rel":193},"https:\u002F\u002Fgithub.com\u002Fkubernetes-sigs\u002Fmetrics-server\u002Fblob\u002Fmaster\u002FFAQ.md",[47],"official metrics-server repository's FAQ",", the default ",[30,197,198],{},"metric-resolution"," is 60 seconds, but setting it below 15 seconds isn't recommended, since 15 seconds is the resolution at which kubelet itself calculates metrics. Many production environments run with ",[30,201,198],{}," set to 15 seconds.",[16,204,205,206,211,212,215,216,221],{},"Separately, the HPA controller has its own sync interval: per the ",[43,207,210],{"href":208,"rel":209},"https:\u002F\u002Fkubernetes.io\u002Fdocs\u002Freference\u002Fcommand-line-tools-reference\u002Fkube-controller-manager\u002F",[47],"kube-controller-manager reference",", the default for ",[30,213,214],{},"--horizontal-pod-autoscaler-sync-period"," is 15 seconds. The ",[43,217,220],{"href":218,"rel":219},"https:\u002F\u002Fkubernetes-sigs.github.io\u002Fmetrics-server\u002F",[47],"official metrics-server site"," also explains that this scrape interval and HPA's polling interval run independently of each other.",[16,223,224],{},[22,225],{"alt":226,"src":227},"section04","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping\u002Fsection04.webp",[16,229,230],{},"That means, at minimum, 15-30 seconds of latency stacks up between a load spike happening and HPA actually \"noticing\" it. If load keeps fluctuating during that window, HPA is always deciding based on a \"slightly stale\" view of the world, which further fuels the flapping.",[11,232,234],{"id":233},"the-fix-set-explicit-policies-and-selectpolicy-in-behavior-to-stop-the-flapping","The fix: set explicit policies and selectPolicy in behavior to stop the flapping",[16,236,237,238,243],{},"Based on the practical recommendations from the ",[43,239,242],{"href":240,"rel":241},"https:\u002F\u002Fmeteorops.com\u002Fblog\u002Fhow-to-configure-kubernetes-hpa-without-causing-scaling-flaps",[47],"MeteorOps blog",", here's how we rewrote the HPA manifest on K3s.",[16,245,246],{},[22,247],{"alt":248,"src":249},"section05","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping\u002Fsection05.webp",[148,251,255],{"className":252,"code":253,"language":254,"meta":156,"style":156},"language-yaml shiki shiki-themes tokyo-night","apiVersion: autoscaling\u002Fv2\nkind: HorizontalPodAutoscaler\nmetadata:\n  name: example\nspec:\n  scaleTargetRef:\n    apiVersion: apps\u002Fv1\n    kind: Deployment\n    name: example\n  minReplicas: 3\n  maxReplicas: 10\n  metrics:\n  - type: Resource\n    resource:\n      name: cpu\n      target:\n        type: Utilization\n        averageUtilization: 65\n  behavior:\n    scaleUp:\n      stabilizationWindowSeconds: 60\n      policies:\n      - type: Pods\n        value: 2\n        periodSeconds: 60\n      selectPolicy: Max\n    scaleDown:\n      stabilizationWindowSeconds: 300\n      policies:\n      - type: Percent\n        value: 25\n        periodSeconds: 60\n      selectPolicy: Min\n","yaml",[30,256,257,274,285,294,305,313,321,332,343,353,365,376,384,399,407,418,426,437,448,456,464,475,483,496,507,517,528,536,546,553,565,575,584],{"__ignoreMap":156},[258,259,262,266,270],"span",{"class":260,"line":261},"line",1,[258,263,265],{"class":264},"s0U2E","apiVersion",[258,267,269],{"class":268},"sAklC",":",[258,271,273],{"class":272},"sPY7s"," autoscaling\u002Fv2\n",[258,275,277,280,282],{"class":260,"line":276},2,[258,278,279],{"class":264},"kind",[258,281,269],{"class":268},[258,283,284],{"class":272}," HorizontalPodAutoscaler\n",[258,286,288,291],{"class":260,"line":287},3,[258,289,290],{"class":264},"metadata",[258,292,293],{"class":268},":\n",[258,295,297,300,302],{"class":260,"line":296},4,[258,298,299],{"class":264},"  name",[258,301,269],{"class":268},[258,303,304],{"class":272}," example\n",[258,306,308,311],{"class":260,"line":307},5,[258,309,310],{"class":264},"spec",[258,312,293],{"class":268},[258,314,316,319],{"class":260,"line":315},6,[258,317,318],{"class":264},"  scaleTargetRef",[258,320,293],{"class":268},[258,322,324,327,329],{"class":260,"line":323},7,[258,325,326],{"class":264},"    apiVersion",[258,328,269],{"class":268},[258,330,331],{"class":272}," apps\u002Fv1\n",[258,333,335,338,340],{"class":260,"line":334},8,[258,336,337],{"class":264},"    kind",[258,339,269],{"class":268},[258,341,342],{"class":272}," Deployment\n",[258,344,346,349,351],{"class":260,"line":345},9,[258,347,348],{"class":264},"    name",[258,350,269],{"class":268},[258,352,304],{"class":272},[258,354,356,359,361],{"class":260,"line":355},10,[258,357,358],{"class":264},"  minReplicas",[258,360,269],{"class":268},[258,362,364],{"class":363},"sOJ5S"," 3\n",[258,366,368,371,373],{"class":260,"line":367},11,[258,369,370],{"class":264},"  maxReplicas",[258,372,269],{"class":268},[258,374,375],{"class":363}," 10\n",[258,377,379,382],{"class":260,"line":378},12,[258,380,381],{"class":264},"  metrics",[258,383,293],{"class":268},[258,385,387,391,394,396],{"class":260,"line":386},13,[258,388,390],{"class":389},"sgJMe","  -",[258,392,393],{"class":264}," type",[258,395,269],{"class":268},[258,397,398],{"class":272}," Resource\n",[258,400,402,405],{"class":260,"line":401},14,[258,403,404],{"class":264},"    resource",[258,406,293],{"class":268},[258,408,410,413,415],{"class":260,"line":409},15,[258,411,412],{"class":264},"      name",[258,414,269],{"class":268},[258,416,417],{"class":272}," cpu\n",[258,419,421,424],{"class":260,"line":420},16,[258,422,423],{"class":264},"      target",[258,425,293],{"class":268},[258,427,429,432,434],{"class":260,"line":428},17,[258,430,431],{"class":264},"        type",[258,433,269],{"class":268},[258,435,436],{"class":272}," Utilization\n",[258,438,440,443,445],{"class":260,"line":439},18,[258,441,442],{"class":264},"        averageUtilization",[258,444,269],{"class":268},[258,446,447],{"class":363}," 65\n",[258,449,451,454],{"class":260,"line":450},19,[258,452,453],{"class":264},"  behavior",[258,455,293],{"class":268},[258,457,459,462],{"class":260,"line":458},20,[258,460,461],{"class":264},"    scaleUp",[258,463,293],{"class":268},[258,465,467,470,472],{"class":260,"line":466},21,[258,468,469],{"class":264},"      stabilizationWindowSeconds",[258,471,269],{"class":268},[258,473,474],{"class":363}," 60\n",[258,476,478,481],{"class":260,"line":477},22,[258,479,480],{"class":264},"      policies",[258,482,293],{"class":268},[258,484,486,489,491,493],{"class":260,"line":485},23,[258,487,488],{"class":389},"      -",[258,490,393],{"class":264},[258,492,269],{"class":268},[258,494,495],{"class":272}," Pods\n",[258,497,499,502,504],{"class":260,"line":498},24,[258,500,501],{"class":264},"        value",[258,503,269],{"class":268},[258,505,506],{"class":363}," 2\n",[258,508,510,513,515],{"class":260,"line":509},25,[258,511,512],{"class":264},"        periodSeconds",[258,514,269],{"class":268},[258,516,474],{"class":363},[258,518,520,523,525],{"class":260,"line":519},26,[258,521,522],{"class":264},"      selectPolicy",[258,524,269],{"class":268},[258,526,527],{"class":272}," Max\n",[258,529,531,534],{"class":260,"line":530},27,[258,532,533],{"class":264},"    scaleDown",[258,535,293],{"class":268},[258,537,539,541,543],{"class":260,"line":538},28,[258,540,469],{"class":264},[258,542,269],{"class":268},[258,544,545],{"class":363}," 300\n",[258,547,549,551],{"class":260,"line":548},29,[258,550,480],{"class":264},[258,552,293],{"class":268},[258,554,556,558,560,562],{"class":260,"line":555},30,[258,557,488],{"class":389},[258,559,393],{"class":264},[258,561,269],{"class":268},[258,563,564],{"class":272}," Percent\n",[258,566,568,570,572],{"class":260,"line":567},31,[258,569,501],{"class":264},[258,571,269],{"class":268},[258,573,574],{"class":363}," 25\n",[258,576,578,580,582],{"class":260,"line":577},32,[258,579,512],{"class":264},[258,581,269],{"class":268},[258,583,474],{"class":363},[258,585,587,589,591],{"class":260,"line":586},33,[258,588,522],{"class":264},[258,590,269],{"class":268},[258,592,593],{"class":272}," Min\n",[16,595,596],{},"There are three key points here.",[77,598,599,606,612],{},[80,600,601,605],{},[602,603,604],"strong",{},"Set the scaleUp stabilization window to 60 seconds",": stop reacting instantly, so short-lived spikes don't trigger overreactions",[80,607,608,611],{},[602,609,610],{},"Cap scaleDown at 25% via a Percent policy",": remove replicas gradually instead of cutting a large batch at once",[80,613,614,617],{},[602,615,616],{},"Switch selectPolicy to Min",": when multiple policies conflict, pick the most conservative (least disruptive) value",[16,619,620,621,624,625,629],{},"Alongside this, it's worth giving CPU requests a safety margin over measured usage and targeting an ",[30,622,623],{},"averageUtilization"," of around 60-75%, per ",[43,626,628],{"href":240,"rel":627},[47],"MeteorOps' recommended values",". Keeping production minReplicas at 3 or more also helps absorb scale-up latency with baseline capacity.",[11,631,633],{"id":632},"dont-relax-just-because-you-set-it-stabilizationwindowseconds-has-a-known-quirk","Don't relax just because you set it — stabilizationWindowSeconds has a known quirk",[16,635,636,637,639,640,645,646,649],{},"Configuring ",[30,638,32],{}," isn't the end of the story. ",[43,641,644],{"href":642,"rel":643},"https:\u002F\u002Fgithub.com\u002Fkubernetes\u002Fkubernetes\u002Fissues\u002F101371",[47],"GitHub Issue #101371 on kubernetes\u002Fkubernetes"," reports cases where, even with ",[30,647,648],{},"stabilizationWindowSeconds: 300"," configured, scale-down actually happens after just 1-2 minutes. It's a known behavioral quirk logged as a bug under SIG Autoscaling.",[16,651,652],{},"In other words, \"I set it to 300 seconds, so it's safe\" isn't a safe assumption on its own — you need to keep monitoring the actual behavior on a dashboard. Configuration and observed behavior are two different things.",[16,654,655,656,660],{},"With Kubo's ",[43,657,659],{"href":45,"rel":658},[47],"Captain UI",", you can watch replica count trends on a real-time graph, making it easier to visually confirm whether things are behaving as configured. Catching this kind of drift early, without having to build your own dashboard, is a real operational advantage.",[11,662,664],{"id":663},"summary","Summary",[16,666,667,668,670],{},"HPA replica count oscillation is more often caused by insufficient ",[30,669,32],{}," design than by broken metrics. In this case, three factors were compounding each other:",[672,673,674,686,689],"ol",{},[80,675,676,677,679,680,682,683,685],{},"The asymmetric defaults of ",[30,678,36],{}," (0 seconds, instant) and ",[30,681,40],{}," (300 seconds) were never overridden with an explicit ",[30,684,32],{}," configuration",[80,687,688],{},"Optimizing CPU requests changed the denominator of utilization, inflating the apparent usage percentage",[80,690,691],{},"The sync intervals of metrics-server and the HPA controller (roughly 15 seconds each) stacked up as latency",[16,693,694,695,697,698,701,702,704],{},"The fix comes down to explicitly setting ",[30,696,74],{},", ",[30,699,700],{},"policies"," (Percent\u002FPods), and ",[30,703,87],{},", and tuning CPU requests to match real usage. But it doesn't end with configuration — you need to keep watching how it actually behaves.",[16,706,707,708,711,712,717,718,723],{},"With K3s-based ",[43,709,48],{"href":45,"rel":710},[47],", you can apply HPA behavior templates via AI-Driven Deployment while visualizing scaling trends in Captain UI. A comparable EKS or AKS setup often runs around ¥82,700-85,710 (roughly $550-570) per month, while Kubo starts at ¥48,000 (roughly $320) for a full-spec Kubernetes setup, as shown on the ",[43,713,716],{"href":714,"rel":715},"https:\u002F\u002Fwww.hexabase.com\u002Fpricing\u002F",[47],"pricing page",". If you'd rather not run production without noticing HPA misconfigurations like this, ",[43,719,722],{"href":720,"rel":721},"https:\u002F\u002Fwww.hexabase.com\u002Fcontact-us\u002F",[47],"get in touch"," for a consultation.",[725,726,727],"style",{},"html pre.shiki code .s0U2E, html code.shiki .s0U2E{--shiki-default:#F7768E}html pre.shiki code .sAklC, html code.shiki .sAklC{--shiki-default:#89DDFF}html pre.shiki code .sPY7s, html code.shiki .sPY7s{--shiki-default:#9ECE6A}html pre.shiki code .sOJ5S, html code.shiki .sOJ5S{--shiki-default:#FF9E64}html pre.shiki code .sgJMe, html code.shiki .sgJMe{--shiki-default:#9ABDF5}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":156,"searchDepth":276,"depth":276,"links":729},[730,731,734,735,736,737,738],{"id":13,"depth":276,"text":14},{"id":55,"depth":276,"text":56,"children":732},[733],{"id":117,"depth":287,"text":118},{"id":129,"depth":276,"text":130},{"id":172,"depth":276,"text":173},{"id":233,"depth":276,"text":234},{"id":632,"depth":276,"text":633},{"id":663,"depth":276,"text":664},"2026-09-22","On K3s, an HPA's replica count kept oscillating every few minutes even though metrics were perfectly healthy. The real cause was the asymmetric scaleUp\u002FscaleDown defaults and missing behavior design. Here's how to fix it with stabilizationWindowSeconds and CPU requests tuning.","md","https:\u002F\u002Fcdn.kubo.hexabase.io\u002Fimages\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping\u002Ftitle.webp","en",{},true,"\u002Fblog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping",{"title":5,"description":740},"blog\u002Fen\u002Fk3s-hpa-scaledown-stabilization-window-replica-flapping",[750,751,752,753,754,755],"k3s","kubernetes","scaling-policy","stabilization-window","replica-flapping","cpu-requests","RYzjowqr_nzSutVQS-7uAw94B8Hcjw1_TsJVpEDYf3k",[758,768,780,790,800,808],{"path":759,"title":760,"description":761,"date":762,"tags":763},"\u002Fblog\u002Fen\u002Fk3s-hpa-containerresource-sidecar-utilization-dilution","HPA Was Scaling on the Sidecar's Share Too. The ContainerResource Blind Spot in Kubernetes","Kubernetes HPA sums resource usage across every container in a Pod, so Istio sidecars and logging agents dilute the scaling decision. Here's how the ContainerResource metric fixes it, in a K3s\u002FKubo context.","2026-10-21",[750,751,764,765,766,767],"hpa","containerresource","autoscaling","service-mesh",{"path":769,"title":770,"description":771,"date":772,"tags":773},"\u002Fblog\u002Fen\u002Fk3s-vs-kubernetes-cni-flannel-default-comparison","K3s vs Standard Kubernetes: How Different Their CNI Starting Points Really Are","K3s ships with Flannel built in, while standard Kubernetes starts with no CNI selected at all. This comparison, grounded in the official K3s, Kubernetes, Calico, and Cilium docs, explains how that difference affects NetworkPolicy enforcement and network performance.","2026-10-20",[750,751,774,775,776,777,778,779],"cni","flannel","calico","cilium","networkpolicy","networking",{"path":781,"title":782,"description":783,"date":784,"tags":785},"\u002Fblog\u002Fen\u002Fk3s-topology-spread-constraints-poddisruptionbudget-node-drain-pending","We Drained a Node and a Pod Never Came Back. Why Topology Spread Constraints and PodDisruptionBudget Collide on K3s","Draining a node in production K3s left a Pod stuck Pending. The cause: Topology Spread Constraints' maxSkew colliding with PodDisruptionBudget. We verify how draining itself creates a node shortage, based on official documentation.","2026-10-19",[750,751,786,787,788,789],"topology-spread-constraints","poddisruptionbudget","scheduling","node-drain",{"path":791,"title":792,"description":793,"date":794,"tags":795},"\u002Fblog\u002Fen\u002Fkyverno-validatingadmissionpolicy-cel-migration-silent-bypass","Is the CEL Rewrite of Your Policy Really the Same? How Migrating from Kyverno to ValidatingAdmissionPolicy Let Some Resources Silently Slip Through","As Kyverno's ClusterPolicy heads toward deprecation, teams migrating to ValidatingAdmissionPolicy (CEL) have found that validation silently skipped for certain resource types. Here's the CEL runtime error and failurePolicy trap behind it, and a safe migration path.","2026-10-18",[750,751,796,797,798,799],"validatingadmissionpolicy","kyverno","cel","admission-control",{"path":801,"title":802,"description":803,"date":804,"tags":805},"\u002Fblog\u002Fen\u002Fk3s-vpa-inplaceorrecreate-pod-resize-cgroup","VPA InPlaceOrRecreate Didn't Stop the Restart. Testing InPlacePodVerticalScaling on K3s","Does VPA's InPlaceOrRecreate mode and In-Place Pod Resize really avoid Pod restarts? We test QoS class constraints and the cgroup v1 trap on K3s with real configs and kubectl commands.","2026-10-17",[750,751,806,766,807],"vpa","cgroup",{"path":809,"title":810,"description":811,"date":812,"tags":813},"\u002Fblog\u002Fen\u002Fk3s-pod-security-admission-restricted-servicelb-outage","We Enabled Restricted and ServiceLB Died: The K3s Pod Security Admission Gap No Generic Guide Mentions","Enabling the restricted Pod Security Admission profile on K3s following standard Kubernetes guides can silently kill ServiceLB. Here's why, backed by K3s's own CIS hardening guide, and how to roll it out safely.","2026-10-16",[750,751,814,815,816,817],"pod-security-admission","pod-security-standards","servicelb","security",1792592636040]