Review the Deployment PodDisruptionBudget

Description

Simultaneous voluntary evictions, such as during node drains, can reduce Deployment availability despite having replicas. A PodDisruptionBudget (PDB) sets disruption limits for operations using the Eviction API.

A PDB does not prevent node failures or direct pod deletion, and does not limit Deployment rolling updates. Configure update strategy and failure-domain distribution separately.

Potential impact

Too few available replicas during maintenance can cause delays or service interruption.
Excessive restrictions can block node drains or maintenance.

Remediation

Define a PDB in the same namespace that selects the actual Deployment pods. Set either max_unavailable or min_available according to availability requirements.
Check readiness, replica counts and replacement capacity, then test draining. Review Deployment rolling updates and pod distribution separately.

Examples

These existing excerpts omit the pod template and other settings. Use kubernetes_pod_disruption_budget_v1 for the current API. With three replicas, max_unavailable of 20% rounds up to one allowed disruption.

Before

hcl

resource "kubernetes_deployment" "example" {
  metadata {
    name = "terraform-example"
    labels = {
      k8s-app = "prometheus"
    }
  }

  spec {
    replicas = 3
  }
}

After

hcl

resource "kubernetes_deployment" "example" {
  metadata {
    name = "terraform-example"
    labels = {
      k8s-app = "prometheus"
    }
  }

  spec {
    replicas = 3

    selector {
      match_labels = {
        k8s-app = "prometheus"
      }
    }
  }
}

resource "kubernetes_pod_disruption_budget" "example" {
  metadata {
    name = "demo"
  }

  spec {
    max_unavailable = "20%"

    selector {
      match_labels = {
        k8s-app = "prometheus"
      }
    }
  }
}

Explanation:

Before: Three replicas are specified without a PDB. Review the acceptable scope of voluntary evictions.
After: The PDB applies when actual pod labels match. It does not guarantee minimum availability against every failure or direct deletion.