Answers: <p>I felt a little bit odd by reading your question, because this would break the kubernetes design principles.</p>
  <p>So checked the <a href="https://github.com/kubernetes-sigs/metrics-server/blob/master/manifests/base/rbac.yaml" rel="nofollow noreferrer">RBAC rules of the metric server provided manifests</a>. There is no role assignment, which would allow the metrics server to delete pods:</p>
  <pre class="lang-yaml prettyprint-override"><code>apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: system:metrics-server
  rules:
    - apiGroups: [&quot;&quot;]
      resources:
        - nodes/metrics
      verbs:
        - get
    - apiGroups: [&quot;&quot;]
      resources:
        - pods
        - nodes
      verbs:
        ## ONLY read verbs allowed here!!!
        - get
        - list
        - watch
  </code></pre>
  <p>There is another ClusterRoleBinding for the <code>system:auth-delegator</code> ClusterRole, but this doesn't allow this eighter:</p>
  <pre class="lang-yaml prettyprint-override"><code>kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: system:auth-delegator
  rules:
    - verbs:
        - create
      apiGroups:
        - authentication.k8s.io
      resources:
        - tokenreviews
    - verbs:
        - create
      apiGroups:
        - authorization.k8s.io
      resources:
        - subjectaccessreviews
  </code></pre>
  <p>This is only to integrate the API Service provided by Metrics-Server.</p>
  <p>So there seems to be no direct way for Metrics-Server to kill pods.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-02-11T14:49:45.783Z
Answers: 2022-02-11T21:06:36.443Z
Answers: 2022-02-11T21:06:36.443Z
Answers: GProssliner
Body: <p>I have a pod (in my on premises Kubernetes cluster) that I setup to eventually try to exceed its memory limit.  When it did that, my pod started throwing an error saying it was out of memory.</p>
  <p>It stayed like that.  With its memory maxed out.  I can kill it manually, but otherwise it will stay just like that.</p>
  <p>However, when I installed <a href="https://github.com/kubernetes-sigs/metrics-server" rel="nofollow noreferrer">Metrics Server</a> and repeat this test, these pods are killed fairly quickly with &quot;out of memory&quot; (once they get near the max memory allowed by the pod).</p>
  <p>So to prove that it was Metrics Server causing it, I uninstalled it, and the previous functionality returned (out of memory errors).</p>
  <p>Lastly I installed Metrics Server again and.... the out of memory errors continued....</p>
  <p>So I am now confused.  What would have been killing my containers when they ran out of memory?  (I  want it to happen, but I need to understand it so I can rely on it.)</p>
  <p><strong>Is it really Metrics Server doing the killing here?  And is this configurable?</strong></p>
  
Tags: <kubernetes>
Title: Does Metrics Server kill pods that use too much memory?
UserDisplayName: Vaccano
ThreadText: # Does Metrics Server kill pods that use too much memory?
  
  (Asked by: username_0 on 2021-08-12)
  
  I have a pod (in my on premises Kubernetes cluster) that I setup to eventually try to exceed its memory limit. When it did that, my pod started throwing an error saying it was out of memory.
  
  It stayed like that. With its memory maxed out. I can kill it manually, but otherwise it will stay just like that.
  
  However, when I installed [Metrics Server](https://github.com/kubernetes-sigs/metrics-server) and repeat this test, these pods are killed fairly quickly with "out of memory" (once they get near the max memory allowed by the pod).
  
  So to prove that it was Metrics Server causing it, I uninstalled it, and the previous functionality returned (out of memory errors).
  
  Lastly I installed Metrics Server again and.... the out of memory errors continued....
  
  So I am now confused. What would have been killing my containers when they ran out of memory? (I want it to happen, but I need to understand it so I can rely on it.)
  
  **Is it really Metrics Server doing the killing here? And is this configurable?**
  
  **Tags:** kubernetes
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2022-02-11. Score: 2
  
  I felt a little bit odd by reading your question, because this would break the kubernetes design principles.
  
  So checked the [RBAC rules of the metric server provided manifests](https://github.com/kubernetes-sigs/metrics-server/blob/master/manifests/base/rbac.yaml). There is no role assignment, which would allow the metrics server to delete pods:
  
  ```yaml
  apiVersion: rbac.authorization.k8s.io/v1
  kind: ClusterRole
  metadata:
    name: system:metrics-server
  rules:
    - apiGroups: [""]
      resources:
        - nodes/metrics
      verbs:
        - get
    - apiGroups: [""]
      resources:
        - pods
        - nodes
      verbs:
        ## ONLY read verbs allowed here!!!
        - get
        - list
        - watch
  
  ```
  
  There is another ClusterRoleBinding for the `system:auth-delegator` ClusterRole, but this doesn't allow this eighter:
  
  ```yaml
  kind: ClusterRole
  apiVersion: rbac.authorization.k8s.io/v1
  metadata:
    name: system:auth-delegator
  rules:
    - verbs:
        - create
      apiGroups:
        - authentication.k8s.io
      resources:
        - tokenreviews
    - verbs:
        - create
      apiGroups:
        - authorization.k8s.io
      resources:
        - subjectaccessreviews
  
  ```
  
  This is only to integrate the API Service provided by Metrics-Server.
  
  So there seems to be no direct way for Metrics-Server to kill pods.
  
  
  ---
  
  