Kubernetes Vertical Pod Autoscaler (VPA) Recommendation Drift Sentinel

id: kubernetes-vertical-pod-autoscaler-drift-sentinel
namespace: company.data

inputs:
  - id: namespace
    type: STRING
    defaults: "default"
    description: Kubernetes namespace to audit for VPA recommendation drift.
  - id: drift_ratio_threshold
    type: FLOAT
    defaults: 2.0
    description: Maximum acceptable ratio between VPA target recommendation and
      configured container requests before alerting.

tasks:
  - id: audit_vpa_recommendations
    type: io.kestra.plugin.scripts.shell.Commands
    containerImage: bitnami/kubectl:latest
    commands:
      - |
        kubectl get vpa -n "{{ inputs.namespace }}" -o json > /tmp/vpa_list.json

        DRIFT_COUNT=$(jq '[.items[]? | select(.status.recommendation.containerRecommendations != null) | .status.recommendation.containerRecommendations[]? | select((.target.cpu? != null) or (.target.memory? != null))] | length' /tmp/vpa_list.json)
        VPA_TOTAL=$(jq '.items | length // 0' /tmp/vpa_list.json)

        echo "::set-output name=drift_count::$DRIFT_COUNT::"
        echo "::set-output name=vpa_total::$VPA_TOTAL::"

  - id: evaluate_vpa_drift
    type: io.kestra.plugin.core.flow.If
    condition: "{{ outputs.audit_vpa_recommendations.vars.drift_count | int > 0 }}"
    then:
      - id: notify_platform_team
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        url: "{{ secret('SLACK_WEBHOOK') }}"
        payload: |
          {
            "channel": "#kubernetes-alerts",
            "attachments": [
              {
                "color": "warning",
                "title": "⚠️ Kubernetes VPA Recommendation Drift Detected",
                "text": "Namespace `{{ inputs.namespace }}` has *{{ outputs.audit_vpa_recommendations.vars.drift_count }}* container recommendations requiring review across *{{ outputs.audit_vpa_recommendations.vars.vpa_total }}* VPA objects. Impact: Workloads running in `Off` or `Initial` updateMode have drifted significantly from their historical CPU/Memory working set recommendations, risking OOMKills or node over-provisioning.",
                "footer": "Kestra Kubernetes Sentinel • VPA"
              }
            ]
          }

errors:
  - id: alert_pipeline_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    url: "{{ secret('SLACK_WEBHOOK') }}"
    payload: |
      {
        "channel": "#kubernetes-alerts",
        "attachments": [
          {
            "color": "danger",
            "title": "⚠️ Kubernetes Vertical Pod Autoscaler (VPA) Recommendation Drift Sentinel Pipeline Failure",
            "text": "Failed to audit Kubernetes VPA resources via kubectl. Check cluster credentials and RBAC permissions.",
            "footer": "Kestra Workflow Failure Sentinel"
          }
        ]
      }

triggers:
  - id: periodic_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    cron: "*/15 * * * *"
    disabled: true