VPA: allow in-place updates below minReplicas for InPlaceOrRecreate, block eviction

[ortherion]

What type of PR is this?

/kind feature

What this PR does / why we need it:

When a replica group has fewer live pods than minReplicas (e.g. one pod with default --min-replicas=2), the VPA updater used to skip it entirely in GetCreatorMaps (if actual < required { continue }). As a result, with updateMode: InPlaceOrRecreate, such groups (single replica or small sets) could never get recommendations applied: no in-place, and we also do not want to evict.

This change:

1. Includes below-minReplicas groups in the maps with a new belowMinReplicas flag in singleGroupStats.
2. Blocks eviction when belowMinReplicas is set: PodsEvictionRestrictionImpl.CanEvict() returns false and logs, so fallback to recreate does not run.
3. Leaves in-place unchanged with respect to minReplicas: PodsInPlaceRestriction does not check belowMinReplicas, so in-place resize is still allowed for these groups.

Result: with InPlaceOrRecreate, groups below minReplicas can receive VPA recommendations only via in-place resize. If in-place is not possible (e.g. Infeasible), we do nothing and log instead of evicting.

Users with one or few replicas and InPlaceOrRecreate can now get VPA resource updates via in-place resize without lowering minReplicas or increasing replica count. Eviction/recreate remains forbidden when below minReplicas, so availability is preserved.

Which issue(s) this PR fixes:

Fixes #9157
#9157

Special notes for your reviewer:

Unit tests in pkg/updater/restriction/ cover: in-place allowed for singleton below minReplicas, tolerance limit in one loop, and fallback to eviction blocked when below minReplicas (TestFallbackToRecreateBlockedWhenBelowMinReplicas).

Does this PR introduce a user-facing change?

VPA (InPlaceOrRecreate): in-place resize is now allowed when the replica group has fewer pods than minReplicas; eviction/recreate remains blocked in that case so single-replica and small replica sets can receive recommendations without being evicted.

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

[k8s-ci-robot]

Adding the "do-not-merge/release-note-label-needed" label because no release-note block was detected, please follow our release note process to remove it.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: ortherion / name: Nickolay Tushin (8f3ee0f)

[k8s-ci-robot]

Welcome @ortherion!

It looks like this is your first PR to kubernetes/autoscaler 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes/autoscaler has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

[k8s-ci-robot]

Hi @ortherion. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ortherion
Once this PR has been reviewed and has the lgtm label, please assign adrianmoisey for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS
• vertical-pod-autoscaler/pkg/apis/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[adrianmoisey]

FYI: this PR is going into a release branch, it should be targeting master.