Vertical Pod Autoscaler (VPA): Right-Sizing Pod Resource Requests

Vertical Pod Autoscaler observes actual pod resource usage over time and produces recommendations for CPU and memory requests and limits. It has three modes with very different risk profiles.

Three modes

• Off — writes recommendations to the VPA object without changing anything; this is the safest mode and what most JVM shops should use.
• Initial — applies the recommended values at pod creation but does not evict running pods.
• Auto — evicts and recreates pods when the recommendation diverges from current; churns pods to resize.

Why Off mode is usually right for JVMs

• Current VPA resizing requires pod eviction — in-place resize is an alpha/beta feature (KEP-1287) not yet generally available.
• Evicting a Spring Boot pod costs 30 to 60 seconds of cold-start latency — daily Auto-mode resizing hurts P99.
• HPA and VPA on the same CPU/memory dimension fight each other — VPA raises requests, HPA utilization percentage drops, HPA scales down; then per-pod usage rises, VPA raises requests again.
• The pragmatic pattern: HPA for horizontal scaling, VPA in Off mode for periodic right-sizing review, apply recommendations via GitOps.

The value VPA delivers even in Off mode

• Evidence-based capacity planning — after 8 days of observation, VPA tells you exactly what this workload needs at P90 CPU and peak memory.
• Removes guesswork from resource requests — teams typically overprovision by 30 to 100 percent; right-sized requests translate directly to cloud bill reduction.
• Better Karpenter bin-packing — tighter requests mean tighter node utilization; VPA + Karpenter compose well even without Auto mode.

Safe combinations with HPA

• HPA on custom metrics (RPS, queue depth) plus VPA in Auto mode on CPU/memory — no dimension conflict.
• HPA on CPU plus VPA in Off mode only — VPA recommends, you apply via GitOps.
• HPA on CPU plus VPA controlling only memory via controlledResources: [memory] — HPA scales on CPU utilization, VPA right-sizes memory without interfering.

Gotchas to watch

• LimitRange can clip VPA recommendations — if namespace LimitRange max is below the recommendation, VPA's applied value is clipped silently.
• PDBs block Auto-mode evictions — strict PDBs mean VPA cannot resize; recommendations linger without being applied.
• Recommender window is ~8 days by default — for workloads with weekly seasonality, extend the window or stage recommendations over multiple cycles.