LimitRange & ResourceQuota

Control resource consumption per namespace: set defaults per container and total budgets per namespace.

intermediate45 minRead → Lab → Quiz → Practice

🧠 Brain Warm-Up

🧠 Brain Warm-Up: A shared cluster has 10 teams. Without any controls, one team could deploy 1000 pods and starve everyone else. What two mechanisms would you use: one for defaults, one for hard caps?

Two Complementary Mechanisms

LimitRange — Per-Container Defaults and Limits

Applied per container in a namespace. If a container has no requests/limits set, LimitRange injects defaults.

Container without requests/limits
        ↓ LimitRange injects defaults
Container with cpu: 100m/500m, memory: 128Mi/512Mi

Also enforces:

min/max: containers must stay within these bounds
maxLimitRequestRatio: limits cannot be more than N× requests

ResourceQuota — Namespace-Level Budget

Hard caps on total resources in a namespace. The scheduler rejects any pod that would exceed the quota.

ResourceQuota:
  requests.cpu: 4        ← total CPU requests across all pods
  limits.memory: 8Gi     ← total memory limits
  count/pods: 20         ← max 20 pods

Why Both?

LimitRange prevents pods with no limits (which can consume unlimited resources)
ResourceQuota prevents a namespace from growing beyond its budget

QoS Classes (Side Effect)

When you set requests = limits, the pod gets Guaranteed QoS. When requests < limits, it gets Burstable. No requests/limits = BestEffort (evicted first under pressure).

←

DNS & CoreDNS

Volumes & PersistentVolumes

→