CKAD — LimitRange & ResourceQuota

1 minute read

LimitRange

A LimitRange sets default and max/min resource values for containers in a namespace. It enforces resource policies without requiring every Pod to specify resources.

Create a LimitRange

apiVersion: v1
kind: LimitRange
metadata:
  name: resource-limits
  namespace: dev
spec:
  limits:
  - type: Container
    default:
      cpu: 500m
      memory: 256Mi
    defaultRequest:
      cpu: 100m
      memory: 128Mi
    max:
      cpu: "2"
      memory: 1Gi
    min:
      cpu: 50m
      memory: 64Mi
  - type: Pod
    max:
      cpu: "4"
      memory: 2Gi

kubectl apply -f limit-range.yaml

# View the LimitRange
kubectl describe limitrange resource-limits -n dev

How LimitRange Works

Field Description
default Default limits if not specified
defaultRequest Default requests if not specified
max Maximum allowed value for requests/limits
min Minimum allowed value for requests/limits

If you create a Pod in the dev namespace without specifying resources, it automatically gets:

  • Request: cpu=100m, memory=128Mi
  • Limit: cpu=500m, memory=256Mi

If you try to create a Pod with requests above max or below min, the Pod is rejected.

ResourceQuota

A ResourceQuota limits the total resource consumption in a namespace. It prevents one team from consuming all cluster resources.

Create a ResourceQuota

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-quota
  namespace: dev
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 4Gi
    limits.cpu: "8"
    limits.memory: 8Gi
    pods: "20"
    services: "10"
    configmaps: "20"
    secrets: "20"
    persistentvolumeclaims: "5"

kubectl apply -f quota.yaml

# Check quota usage
kubectl get resourcequota team-quota -n dev
# Expected:
# NAME         AGE   REQUEST                                          LIMIT
# team-quota   10s   pods: 3/20, requests.cpu: 750m/4, ...           limits.cpu: 1500m/8, ...

# Detailed view
kubectl describe resourcequota team-quota -n dev

What ResourceQuota Enforces

When a ResourceQuota is set for a namespace:

  • Every Pod must specify resource requests and limits (or have a LimitRange providing defaults)
  • Creating resources that would exceed the quota is rejected
# This will fail if it exceeds the quota
kubectl run big-pod --image=nginx --dry-run=client -o yaml | kubectl apply -f -
# Error: pods "big-pod" is forbidden: failed quota: team-quota:
# must specify requests.cpu, requests.memory

Best practice: Always use a LimitRange alongside ResourceQuota. The LimitRange provides default values so developers do not have to specify resources on every Pod.

Next: Monitoring Resource Usage →

Updated:

You may also enjoy