Chapter 23 of 47 · Resource management, part 2

Namespaces, ResourceQuotas and LimitRanges

Requests and limits are set by whoever writes the Deployment. But what if a team forgets them, or asks for 50 CPUs? Cluster admins set rules per namespace: a ResourceQuota caps the namespace's total, and a LimitRange sets defaults and bounds for each container.

Namespaces in two minutes

A namespace is a folder inside the cluster. Names only have to be unique within one, and many rules, quotas and permissions included, apply per namespace.

$ kubectl create namespace team-a
$ kubectl apply -f all.yaml -n team-a        # deploy into it
$ kubectl get pods -n team-a                 # look inside it
$ kubectl get pods -A                        # every namespace
$ kubectl config set-context --current --namespace=team-a   # make it your default

Services in another namespace are reached as http://posts-srv.team-a (chapter 11). kube-system holds Kubernetes' own components; leave it alone.

Three levels of rules

ResourceQuota

A budget for the whole namespace. Every new object is checked against it; anything that would go over is refused at creation, not killed later.

apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi
    limits.cpu: "4"
    limits.memory: 8Gi
    pods: "10"
    services: "5"
    configmaps: "10"
    secrets: "10"
    services.loadbalancers: "1"
    persistentvolumeclaims: "4"
    requests.storage: 20Gi

Warning  FailedCreate  replicaset/posts-depl-7d9f8  Error creating: pods "posts-depl-7d9f8-x2k" is forbidden:
exceeded quota: team-quota, requested: requests.cpu=500m, used: requests.cpu=1800m, limited: requests.cpu=2

LimitRange

Rules for each container in the namespace: fill in what is missing, and refuse what is out of bounds.

apiVersion: v1
kind: LimitRange
metadata:
  name: container-defaults
  namespace: team-a
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: 250m
        memory: 256Mi
      default:
        cpu: 500m
        memory: 512Mi
      min:
        cpu: 50m
        memory: 64Mi
      max:
        cpu: "2"
        memory: 2Gi

Error: pods "big" is forbidden: maximum cpu usage per Container is 2, but limit is 4

Try them together

Namespace team-a has a quota of 2 CPU, 4Gi and 4 Pods. First add Pods with "not set" requests and the LimitRange off, then turn it on:

• No requests + quota on requests → rejected ("must specify").
• Same Pod with a LimitRange → defaults filled in, accepted.
• Going past the total → rejected with exactly which resource is exhausted.

Checking with kubectl

$ kubectl describe resourcequota team-quota -n team-a
Name:            team-quota
Namespace:       team-a
Resource         Used   Hard
--------         ----   ----
pods             3      10
requests.cpu     1500m  2
requests.memory  2Gi    4Gi
limits.cpu       3      4
limits.memory    4Gi    8Gi
services         2      5

$ kubectl describe limitrange container-defaults -n team-a
Type        Resource  Min   Max  Default Request  Default Limit
----        --------  ---   ---  ---------------  -------------
Container   cpu       50m   2    250m             500m
Container   memory    64Mi  2Gi  256Mi            512Mi

Recap

• A namespace is a folder in the cluster; quotas and LimitRanges apply per namespace.
• ResourceQuota: a total budget (CPU, memory, object counts) for the namespace. Over budget means refused at creation.
• LimitRange: per-container defaults (defaultRequest, default) and bounds (min, max).
• A compute quota requires every Pod to set requests, so pair it with a LimitRange.
• Blocked Deployment Pods show up in kubectl get events, not in apply output.

Quick check