Kubernetes provides powerful resource management tools to help you control how resources are allocated to containers within your clusters. One such tool is LimitRange. LimitRange helps administrators set limits on the resource usage (CPU, memory) and enforce constraints on a per-namespace basis. This is particularly useful in multi-tenant environments where you want to prevent a single pod from consuming excessive resources that could affect other workloads running in the same namespace.
In this blog post, we’ll walk you through what LimitRange is, why it's useful, and provide a detailed example of how to create a namespace and apply a LimitRange with Kubernetes manifest files.
What is LimitRange?
In Kubernetes, a LimitRange is a resource that sets default resource requests and limits for containers in a specific namespace. It allows cluster administrators to:
- Set default resource requests and limits for containers if they are not specified by the user.
- Prevent users from creating containers that exceed certain resource limits.
- Ensure fair resource distribution within a namespace and prevent resource starvation or hogging.
Use Cases for LimitRange
Prevent resource overuse: By setting CPU and memory limits, you can prevent runaway containers that consume excessive resources.
Enforce resource policies: Set upper and lower bounds for resources to align with your organization's resource allocation policies.
Define defaults: If a container doesn't specify resource requests or limits, Kubernetes will use the default values from LimitRange.
Key Concepts
Resource Request: The amount of CPU and memory a container requests from the scheduler.
Resource Limit: The maximum amount of CPU and memory a container can consume.
Default Request: A default resource request applied to containers that do not specify one.
Default Limit: A default resource limit applied to containers that do not specify one.
Example: Creating a Namespace and Applying LimitRange
Let’s go through a practical example of how to create a Namespace and apply a LimitRange to that namespace.
1. Create a Namespace
Before applying a LimitRange, we need to define the namespace where it will be applied. You can create a namespace using a manifest file or with the kubectl command.
Here's a simple YAML manifest to create a namespace named dev-namespace:
apiVersion: v1
kind: Namespace
metadata:
name: dev-namespace
To apply this manifest, save it as namespace.yaml and run:
kubectl apply -f namespace.yaml
2. Define the LimitRange
Now that we have the namespace, we can create a LimitRange that sets default CPU and memory requests and limits for any container running in the dev-namespace.
Here’s an example of a LimitRange manifest:
apiVersion: v1
kind: LimitRange
metadata:
name: resource-limits
namespace: dev-namespace
spec:
limits:
- max:
cpu: "500m"
memory: "1Gi"
min:
cpu: "100m"
memory: "128Mi"
default:
cpu: "200m"
memory: "512Mi"
defaultRequest:
cpu: "200m"
memory: "256Mi"
type: Container
Explanation:
max: The maximum amount of CPU (500m, or 0.5 CPUs) and memory (1Gi, 1 GiB) that containers can use in the namespace.
min: The minimum amount of CPU (100m) and memory (128Mi) that must be requested by containers.
default: The default CPU (200m) and memory (512Mi) that will be applied to containers that do not specify these values.
defaultRequest: The default CPU (200m) and memory (256Mi) that will be requested by containers if not explicitly set.
type: Specifies that the limit range applies to containers.
To apply this LimitRange, save the YAML file as limitrange.yaml and run:
kubectl apply -f limitrange.yaml
3. Verify the LimitRange
After applying the LimitRange, you can verify that it has been successfully created in the dev-namespace:
kubectl get limitrange -n dev-namespace
This should show the resource-limits LimitRange applied to the namespace.
4. Create a Pod that Exceeds Limits
Now let’s create a pod within the dev-namespace that does not specify resource requests or limits. This pod will automatically inherit the defaults defined in the LimitRange.
Create a pod.yaml file:
apiVersion: v1
kind: Pod
metadata:
name: example-pod
namespace: dev-namespace
spec:
containers:
- name: example-container
image: nginx
Apply this file with:
kubectl apply -f pod.yaml
The pod will be created, and Kubernetes will apply the default CPU and memory values from the LimitRange, which in this case are 200m CPU and 512Mi memory for the container.
5. Create a Pod that Violates the Limits
Let’s now create a pod that violates the defined limits. For example, we might try to create a pod that requests more memory than the maximum allowed by the LimitRange.
Here’s an example pod.yaml that tries to allocate more memory than the defined max:
apiVersion: v1
kind: Pod
metadata:
name: invalid-pod
namespace: dev-namespace
spec:
containers:
- name: invalid-container
image: nginx
resources:
requests:
memory: "2Gi"
limits:
memory: "2Gi"
If you apply this manifest:
kubectl apply -f pod.yaml
Kubernetes will reject the pod creation because the memory request and limit exceed the maximum memory defined in the LimitRange (which is 1Gi).
Conclusion
Kubernetes LimitRange is an important feature for controlling resource usage at the namespace level. It helps maintain a balance between resource efficiency and fairness in multi-tenant environments. By setting default requests and limits, you can ensure that containers don’t consume too many resources or go underutilized, leading to more predictable and manageable workloads.
Key Takeaways:
- LimitRange helps you set default resource requests and limits for containers in a namespace.
- It enables you to define maximum and minimum resource boundaries for containers.
- By using LimitRange, you can ensure that containers do not exceed specified resource limits and can manage resources efficiently within your cluster.
If you’re managing Kubernetes at scale, understanding and using LimitRange will help you enforce resource policies and maintain a healthy cluster environment.
SOCIAL SHARE CARD GENERATOR