Namespaces, ResourceQuotas and LimitRanges

Cluster Architecture and Configuration / Guide 17 of 103 / Intermediate

• Kubernetes1.36.4
• Cluster4 nodes
• Runtimecontainerd 2.2.6
• CNICalico v3.32.1
• TimeAbout 35 min

The specific limits are arbitrary. Which object rejects what, and when, is not.

This guide includes

Use this when a namespace needs a budget, or when a Deployment is quietly running fewer replicas than you asked for. This matters because a quota caps the namespace in total while a LimitRange constrains each container, and the two are enforced at different moments by different things.

• seeing what a namespace scopes, which resources are not namespaced, and how deletion cascades
• setting a default namespace on your context instead of typing -n on every command
• applying a ResourceQuota and a LimitRange, and stating plainly what each one does
• creating a Pod with no resource flags and finding values it never asked for, then asking for far too much
• seeing a Deployment stall rather than fail at the quota, then reading the quota's status.used

Before you start

• A working cluster and kubectl.
• The requests, limits and QoS guide. Quotas are written in terms of requests.cpu and limits.memory, so those need to mean something to you first.
• The kubectl session guide, for the difference between namespaced and cluster-scoped resources.

1. 1

   What a namespace is, and what it is not

2. 2

   Set a default namespace instead of typing -n

3. 3

   Namespace deletion is a cascade

4. 4

   A quota and a LimitRange, and why you need both

5. 5

   Watch a Pod receive resources it never asked for

6. 6

   The rejection you get is not always the one you expected

7. 7

   A Deployment does not fail, it stalls

8. 8

   Read the totals, and clean up

Official sources

• Namespaces
• Resource quotas
• Limit ranges
• Configure default CPU requests and limits for a namespace
• Configure memory and CPU quotas for a namespace
• Namespaces walkthrough