Kubernetes PodDisruptionBudget Generator

A PodDisruptionBudget is a Kubernetes policy resource that limits the number of pods that can be voluntarily disrupted at one time. Voluntary disruptions include node drains (kubectl drain), cluster upgrades, and evictions by the Cluster Autoscaler. A PDB protects your service's availability during these maintenance operations by telling Kubernetes: 'don't evict pods if it would leave fewer than N available.' PDBs do NOT protect against involuntary disruptions like hardware failures or OOMKill.

minAvailable sets the minimum number (or percentage) of pods that must be running and ready at all times. Kubernetes won't evict a pod if doing so would drop below this threshold. maxUnavailable sets the maximum number (or percentage) of pods that can be unavailable at the same time. Kubernetes won't evict a pod if already maxUnavailable pods are down. minAvailable is easier to reason about for stateful services; maxUnavailable maps naturally to rolling update semantics. Pick one — don't set both in the same PDB.

Use a percentage if your deployment scales up and down frequently (e.g., with HPA). Percentages scale with your replica count automatically — minAvailable: 50% on a 10-replica deployment allows 5 disruptions; on a 4-replica deployment it allows 2. Use a fixed number if you have a stable replica count or need precise guarantees (e.g., minAvailable: 2 on a 3-replica stateful cluster ensures at least 2 nodes stay up for quorum). Important: if minAvailable equals your total replica count, no voluntary evictions are ever permitted — kubectl drain will block forever.

By default, Kubernetes won't evict unhealthy pods (not Running or not Ready) if they count against the PDB budget. This can cause kubectl drain to hang when you have crashed pods. Setting unhealthyPodEvictionPolicy: AlwaysAllow lets Kubernetes evict unhealthy pods regardless of the PDB budget. This was added in Kubernetes 1.26. Use it when you want drains to succeed even when pods are already failing — but be aware it may reduce your available pod count below minAvailable temporarily.

Both the Cluster Autoscaler and kubectl drain are PDB-aware — they check existing PDBs before evicting pods. If evicting a pod would violate a PDB, the operation blocks and retries until it's safe. kubectl drain will print a 'Cannot evict pod as it would violate the pod's disruption budget' message and wait. The Cluster Autoscaler will skip a node and retry on the next cycle. This is exactly the behavior you want — it prevents scale-down or drain from breaking your service's availability guarantees.

matchLabels selects which pods this PDB applies to, using the same label selectors as Kubernetes Services and Deployments. Run kubectl get pods --show-labels to see pod labels, or kubectl get deployment my-app -o yaml to find the selector. Typically you'd match the same labels as your Deployment's selector (e.g., app: my-app, version: v2). The PDB only applies to pods it selects — if your selector doesn't match any pods, the PDB has no effect.