To right-size Kubernetes requests, run the Vertical Pod Autoscaler in recommendation mode, deploy Goldilocks to read its recommendations, label your namespaces, then set requests to the recommended target with a margin for peaks. VPA does the math from observed usage; Goldilocks makes it readable per workload. Keep VPA in recommendation mode, not auto, so it never evicts pods or fights the Horizontal Pod Autoscaler. Right-sizing over provisioned requests commonly recovers 30 to 50 percent of reserved resources.
Last updated: June 2026. Written by Morten Andersen and reviewed by Fredrik Filipsson, built on our See, Cut, Lock, Run method.
This article sits in our complete guide to Kubernetes cost optimization, the cluster pillar it links up to, and connects to the broader cloud cost optimization playbook. Right-sized requests feed directly into node efficiency, so pair this with our companion guide on how to tune Karpenter consolidation for maximum savings. Right-sizing is the first Cut step move, done before you pack nodes or buy commitments.
Run VPA in recommendation mode, never auto. Auto mode evicts and recreates pods to apply new requests, which causes disruption, and it conflicts with the Horizontal Pod Autoscaler when both act on CPU or memory. Recommendation mode gives you the full savings signal with zero pod churn. Read the recommendation, apply it deliberately through your manifests or Helm values, and you keep control while still capturing the waste.
What are VPA and Goldilocks?
The Vertical Pod Autoscaler is the Kubernetes component that recommends CPU and memory requests from a workload's observed usage. Goldilocks is a Fairwinds open source controller and dashboard that runs VPA in recommendation mode and presents its target, lower bound, and upper bound per workload in a readable view. VPA produces the numbers; Goldilocks surfaces them so a platform team can see, at a glance, which deployments are over requested and by how much. Together they replace guesswork and inherited defaults with data on what each pod truly needs.
How do I set it up, step by step?
Set it up by installing VPA in recommendation mode, deploying Goldilocks, labeling namespaces, then reading and applying the target. Six steps:
- Install VPA in recommendation mode. Deploy the Vertical Pod Autoscaler with the updater off so it only recommends and never evicts. Result: a safe recommendation engine, no pod churn.
- Deploy Goldilocks. Install the Goldilocks controller and dashboard. Result: VPA recommendations rendered per workload.
- Label namespaces for analysis. Add the goldilocks.fairwinds.com/enabled label to each namespace you want analyzed. Result: VPA objects created and the dashboard populated.
- Read the target recommendation. Use the Guaranteed target for requests equal to limits, or the Burstable lower and upper bounds for headroom. Result: a defensible request value per workload.
- Set requests and limits. Apply the recommended requests in your manifests or Helm values, keeping a margin above steady usage. Result: requested capacity drops toward real usage.
- Re-check after traffic settles. Revisit recommendations after a representative window. Result: seasonal peaks are captured before you finalize.
How do I read the Goldilocks recommendations?
Read Goldilocks by choosing between its Guaranteed and Burstable recommendations per workload. The Guaranteed recommendation sets requests equal to limits using the VPA target value, which suits steady, predictable services. The Burstable recommendation uses the VPA lower bound for requests and the upper bound for limits, giving headroom for workloads with variable load. Pick Guaranteed when you want predictable scheduling and tight packing, and Burstable when a service spikes and you want it to absorb bursts without being throttled. In both cases the target is grounded in real observed usage, not a guess.
Want every over provisioned workload found and right-sized?
Our Kubernetes cost audit runs VPA and Goldilocks across your namespaces, ranks workloads by wasted requests, and applies right-sized values with the headroom each service needs. On the performance model, you pay only from realized savings. No savings, no fee.
Book a Kubernetes cost audit →Can I run VPA and HPA together?
You can run VPA and HPA together, but only if they act on different dimensions. Running both on the same CPU or memory metric makes workloads behave erratically because each tries to control the same signal, scaling and resizing against each other. The safe pattern is the Horizontal Pod Autoscaler scaling replica count on a custom or external metric such as queue depth or request rate, while VPA runs in recommendation mode to right-size per pod requests. That separation lets you scale out for load and size correctly for cost without the two fighting.
The Kubernetes Cost Optimization Handbook includes the VPA and Goldilocks rollout checklist and the request headroom guidance referenced above. It is the downloadable companion to this guide.
Frequently asked questions
What is the difference between VPA and Goldilocks?
The Vertical Pod Autoscaler is the Kubernetes component that calculates recommended CPU and memory requests from observed usage. Goldilocks is a Fairwinds open source dashboard that runs VPA in recommendation mode and presents its target, lower bound, and upper bound per workload in a readable view. VPA does the math; Goldilocks makes it visible and easy to act on.
Should I run VPA in auto mode?
For most teams, no. Fairwinds and common practice recommend running VPA in recommendation mode only, with the updater off, because auto mode evicts and recreates pods to apply new requests and can conflict with the Horizontal Pod Autoscaler when both act on CPU or memory. Recommendation mode gives you the savings signal without the disruption.
Can I use VPA and HPA together?
You can, but carefully. Running both on the same CPU or memory metric makes workloads behave erratically because each tries to act on the same signal. The safe pattern is HPA on a custom or external metric for scaling out, and VPA in recommendation mode to right-size requests, so the two are not fighting over the same dimension.
How much can right-sizing requests save?
Right-sizing over provisioned requests commonly cuts 30 to 50 percent off the resources a workload reserves, because most teams set requests with large safety margins they never use. On Standard nodes you pay for requested capacity, so lowering requests to match real usage directly lowers the bill. Validate against your own usage before applying.
The short version
Install VPA in recommendation mode, deploy Goldilocks, label your namespaces, read the target, and apply right-sized requests with headroom, re-checking after a full traffic window. Keep VPA off auto so it never evicts or fights HPA. When you want every workload right-sized for you, that is what our rightsizing and waste elimination service delivers.
Cloud pricing and service behavior change frequently. Verify the specifics in this guide against the providers’ own current documentation and the FinOps Foundation: FinOps Foundation Framework ↗ and FinOps Rate Optimization capability ↗. This article also reflects Cloud Cost Room’s hands-on, vendor-neutral engagement experience.