What PodDisruptionBudgets Actually Protect Against

▶ Watch (0:01)

PDBs have two settings: minAvailable or maxUnavailable. Pick one. Setting both makes the PDB invalid. They apply only to voluntary disruptions, and only when a call goes through the eviction API, not the delete API. Kubernetes documentation frames the goal as preventing too many pods from going down simultaneously during voluntary disruptions. That scope is narrower than most engineers assume, and the rest of the talk is about the gaps.

Where PDBs Offer No Protection

▶ Watch (3:08)

Involuntary disruptions bypass PDBs entirely. Hardware failure, kernel panic, hypervisor crash, network partition, and spot-node reclamation all fall outside Kubernetes control. At Saxo Bank, monthly continuity tests disconnect one data center. In that scenario all pods in the partitioned zone become unreachable, and Kubernetes needs five minutes just to recognize their state. Spot nodes add a related risk: the VM exists now and is gone a minute later. PDBs count those losses against the budget but cannot stop them.

The Delete Call and Rollout Restart Gaps

▶ Watch (0:54)

The incident that prompted this talk: during a routine ingress controller update, Kubernetes evicted a Prometheus pod to free space on a node. The PDB did not help. The live demo confirmed two more bypasses. A direct kubectl delete pod against a deployment with minAvailable 30 deleted the pod without complaint. A kubectl rollout restart on the same deployment dropped the replica count below the PDB threshold immediately. Both ignore PDBs because they go through the delete API or the deployment update strategy, not the eviction API.

Pod Priority and Preemption Override PDBs

▶ Watch (9:32)

Priority classes assign a relative importance value to pods. When a higher-priority pod needs space and the node is full, it preempts lower-priority pods. That eviction ignores any PDB on the preempted pod. The demo scaled a high-priority deployment against a cluster already at capacity. The no-priority pods dropped first, then the low-priority pods, regardless of their PDB settings. The default priority is zero, so all pods without an explicit class are treated as equals and are equally exposed.

Node Drain: The One Place PDBs Work Reliably

▶ Watch (16:58)

Node drain goes through the eviction API by default. The demo drained one of two kind nodes and showed the low-priority deployment with minAvailable 30 holding steady while unprotected pods moved off. The API server returned a 429 when eviction was attempted against the protected deployment, with a message stating it needed 30 healthy pods. Adding --disable-eviction to the drain command switched the call to direct deletes and all pods, including the protected ones, were removed immediately.

Compensating Controls Beyond PDBs

▶ Watch (20:38)

Four controls fill the gaps PDBs leave. First, set resource requests accurately. Limits are best-effort; requests are the only guaranteed allocation. Second, combine pod replication with topology spread constraints or pod anti-affinity so replicas do not land in the same node or zone. Third, align the deployment update strategy with PDB expectations. A PDB expecting one pod down at a time does nothing if the update strategy allows 100% replacement. Fourth, assign priority classes to workloads that must survive preemption. Quality of service only breaks ties when node memory pressure hits and priority classes are equal.

Notable Quotes

blindly of course you should not trust it u you need to be aware of as I try to highlight most of the things in here you need to be aware of all the things that are taken into account in different scenarios uh so you are not surprised like me when I got call from my manager suddenly saying hey we’re blind Kārlis Akots Gribulis · ▶ 23:18

pod disruption budgets are completely ignored. And the reason why it’s ignored is because of something called update strategy. Kārlis Akots Gribulis · ▶ 16:21

at that point, uh PDBs felt like a nice Swiss cheese. It’s, you know, it’s nice, but it has a lot of holes. Kārlis Akots Gribulis · ▶ 01:32

Key Takeaways

  • Direct delete calls and rollout restarts bypass PDBs entirely; only eviction API calls respect them.
  • Pod preemption by higher-priority workloads removes pods regardless of any PDB in place.
  • Node drain with --disable-eviction converts eviction calls to delete calls, removing all PDB protection.

About the Speaker(s)

Kārlis Akots Gribulis is a Senior Container Platform Engineer at Saxo Bank, a Danish financial institution with 100 billion USD in client assets and 1.5 million clients. He has previously built Kubernetes clusters at Accenture and Vox, and has hands-on experience deploying, managing, and optimizing clusters across multiple companies in the cloud-native space.