CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

Denial of Service and Resource Controls

Availability is the third of the three properties, and the one Kubernetes gives away by default: a container with no resources block may take the whole node. This guide measures that, then works outward through the container, the namespace, the apiserver and the node - reading each control off a live cluster.

Kubernetes Threat Model Guide 31 of 42 Intermediate

Memory limits are enforced by the kernel's cgroup v2 controller, so exceeding one is an OOM kill at exit 137 rather than a Kubernetes decision. API Priority and Fairness has been on by default since 1.20.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

This guide includes

Use this when availability is part of the review. This matters because Kubernetes gives resources away by default - a Pod with no limits can take a node down - and the controls that stop it sit at three different levels.

Before you start

  1. The default, which is no ceiling at all

  2. What the container can see of the node

  3. One limit, and the kernel enforcing it

  4. The three classes, and the one everybody gets wrong

  5. The namespace control that fixes it for everyone

  6. The apiserver defends itself, and always has

  7. And the node keeps something back for itself

Official sources

← All KCSA guides