Azure Aks automatic PDB

Azure AKS Automatic PDB provides automatic protection for your deployments during kubernetes upgrades or evictions. It supports HPA, KEDA and straight up deployment. One significant benenift is AKS upgrade sometimes are blocked by too restrictive PDB, with this extension we would be able to manage our cluster

Installing the extension

az feature register --namespace Microsoft.KubernetesConfiguration --name Extensions

# Verify registration status

az feature show --namespace Microsoft.KubernetesConfiguration --name Extensions

# After the feature shows "Registered", refresh the provider

az provider register -n Microsoft.KubernetesConfiguration

Verifying the installation 

kubectl get pdb -A -o custom-columns=NAME:.metadata.name,NAMESPACE:.metadata.namespace,MIN-AVAILABLE:.spec.minAvailable,OWNER:.metadata.annotations.ownedBy | grep EvictionAutoScaler

Setting up cluster wide PDB management

Here we will target specific all namespaces

az k8s-extension create --cluster-name <cluster-name> --cluster-type managedClusters --extension-type microsoft.evictionautoscaler --name eviction-autoscaler --resource-group <resource-group-name> --release-train stable --configuration-settings controllerConfig.pdb.create=true controllerConfig.namespaces.enabledByDefault=true --auto-upgrade-minor-version true

Setting up specific namespace PDB management

Here we will target specific namespace called kube-system and production.

az k8s-extension create --cluster-name <cluster-name> --cluster-type managedClusters --extension-type microsoft.evictionautoscaler --name eviction-autoscaler --resource-group <resource-group-name> --release-train stable --configuration-settings controllerConfig.pdb.create=true controllerConfig.namespaces.actionedNamespaces="{kube-system,production}" --auto-upgrade-minor-version true

We can also annotate our namespace so our PDB automatic extension go to work. Ensure we annotate our namespace like so, with  eviction-autoscaler.azure.com/enable: "true"

apiVersion: v1

kind: Namespace

metadata:

  name: my-namespace

  annotations:

    eviction-autoscaler.azure.com/enable: "true"

What is being supported (from AKS docs - Microsoft)

So it supports deployment, KEDA and HPA but not both KEDA + HPA together as shown in the docs here.

Configuration	How the extension surges	How the extension reverts	Notes
Deployment only	Increases the deployment's replicas directly.	Restores the original replica count after the cooldown.	Default behavior when no autoscaler is attached.
Deployment + HPA	Raises the HPA's minReplicas floor and adds a replica immediately, so the HPA doesn't scale back down mid-drain and doesn't wait for its metrics cycle.	Restores the original minReplicas; the HPA handles scale-down naturally.	Safe coordination with a single HPA.
Deployment + KEDA	Raises the minReplicaCount on the ScaledObject and adds a replica immediately, because KEDA has an extra latency hop (KEDA syncs to its HPA, then the HPA syncs to the deployment).	Restores the original minReplicaCount; KEDA and its HPA handle scale-down.	Safe coordination with a single KEDA ScaledObject.
Deployment + KEDA + a separate HPA	Not supported. KEDA already creates its own HPA, so a second HPA produces conflicting writes to the same deployment.	The extension marks itself Degraded on the EvictionAutoScaler status and doesn't surge, because it can't safely coordinate two autoscalers writing to the same target.	Inspect the EvictionAutoScaler resource status and remove the extra HPA to fix.