Hands-on Lab·Certified Kubernetes Administrator
Namespaces, ResourceQuotas and LimitRanges
A quota caps a namespace in total, a LimitRange constrains each container, and they are enforced at different moments by different code. Watch a Pod get defaults it never asked for, get a rejection from the LimitRange rather than the quota you expected, and watch a Deployment stall at 3 of 6 replicas.
Cluster Architecture and Configuration Guide 17 of 103 Intermediate
- Kubernetes1.36.4
- Cluster4 nodes
- Runtimecontainerd 2.2.6
- CNICalico v3.32.1
- TimeAbout 35 min
- Reviewed21 August 2026
Written against the versions above. The specific limits are arbitrary. Which object rejects what, and when, is not.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA1001 | 192.168.0.175 | Ubuntu 26.04 LTS | Control Plane Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE01 | 192.168.0.176 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE02 | 192.168.0.177 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA1001-NODE03 | 192.168.0.178 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
Before you start
- A working cluster and
kubectl. - The requests, limits and QoS guide. Quotas are written in terms of
requests.cpuandlimits.memory, so those need to mean something to you first. - The kubectl session guide, for the difference between namespaced and cluster-scoped resources.
-
What a namespace is, and what it is not
-
Set a default namespace instead of typing -n
-
Namespace deletion is a cascade
-
A quota and a LimitRange, and why you need both
-
Watch a Pod receive resources it never asked for
-
The rejection you get is not always the one you expected
-
A Deployment does not fail, it stalls
-
Read the totals, and clean up