|
|
@@ -41,7 +41,7 @@ A limit range is enforced in a particular namespace when there is a
|
|
|
|
- If creating or updating a resource (Pod, Container, PersistentVolumeClaim) violates a limit range constraint, the request to the API server will fail with HTTP status code `403 FORBIDDEN` and a message explaining the constraint that would have been violated.
|
|
|
|
- If creating or updating a resource (Pod, Container, PersistentVolumeClaim) violates a limit range constraint, the request to the API server will fail with HTTP status code `403 FORBIDDEN` and a message explaining the constraint that would have been violated.
|
|
|
|
- If limit range is activated in a namespace for compute resources like `cpu` and `memory`, users must specify
|
|
|
|
- If limit range is activated in a namespace for compute resources like `cpu` and `memory`, users must specify
|
|
|
|
requests or limits for those values; otherwise, the system may reject pod creation.
|
|
|
|
requests or limits for those values; otherwise, the system may reject pod creation.
|
|
|
|
- LimitRange validations occurs only at Pod Admission stage, not on Running pods.
|
|
|
|
- LimitRange validations occurs only at Pod Admission stage, not on Running pods.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Examples of policies that could be created using limit range are:
|
|
|
|
Examples of policies that could be created using limit range are:
|
|
|
@@ -60,13 +60,13 @@ The following section discusses the creation of a LimitRange acting at Container
|
|
|
|
A Pod with 04 containers is first created; each container within the Pod has a specific `spec.resource` configuration
|
|
|
|
A Pod with 04 containers is first created; each container within the Pod has a specific `spec.resource` configuration
|
|
|
|
each container within the pod is handled differently by the LimitRanger admission controller.
|
|
|
|
each container within the pod is handled differently by the LimitRanger admission controller.
|
|
|
|
|
|
|
|
|
|
|
|
Create a namespace `limitrange-demo` using the following kubectl command
|
|
|
|
Create a namespace `limitrange-demo` using the following kubectl command:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl create namespace limitrange-demo
|
|
|
|
kubectl create namespace limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
To avoid passing the target limitrange-demo in your kubectl commands, change your context with the following command
|
|
|
|
To avoid passing the target limitrange-demo in your kubectl commands, change your context with the following command:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl config set-context --current --namespace=limitrange-demo
|
|
|
|
kubectl config set-context --current --namespace=limitrange-demo
|
|
|
@@ -77,16 +77,15 @@ Here is the configuration file for a LimitRange object:
|
|
|
|
|
|
|
|
|
|
|
|
This object defines minimum and maximum Memory/CPU limits, default cpu/Memory requests and default limits for CPU/Memory resources to be apply to containers.
|
|
|
|
This object defines minimum and maximum Memory/CPU limits, default cpu/Memory requests and default limits for CPU/Memory resources to be apply to containers.
|
|
|
|
|
|
|
|
|
|
|
|
Create the `limit-mem-cpu-per-container` LimitRange in the `limitrange-demo` namespace with the following kubectl command.
|
|
|
|
Create the `limit-mem-cpu-per-container` LimitRange in the `limitrange-demo` namespace with the following kubectl command:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl create -f https://k8s.io/examples/admin/resource/limit-mem-cpu-container.yaml -n limitrange-demo
|
|
|
|
kubectl create -f https://k8s.io/examples/admin/resource/limit-mem-cpu-container.yaml -n limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl describe limitrange/limit-mem-cpu-per-container -n limitrange-demo
|
|
|
|
kubectl describe limitrange/limit-mem-cpu-per-container -n limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
Type Resource Min Max Default Request Default Limit Max Limit/Request Ratio
|
|
|
|
Type Resource Min Max Default Request Default Limit Max Limit/Request Ratio
|
|
|
@@ -95,19 +94,18 @@ Container cpu 100m 800m 110m 700m -
|
|
|
|
Container memory 99Mi 1Gi 111Mi 900Mi -
|
|
|
|
Container memory 99Mi 1Gi 111Mi 900Mi -
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Here is the configuration file for a Pod with 04 containers to demonstrate LimitRange features :
|
|
|
|
Here is the configuration file for a Pod with 04 containers to demonstrate LimitRange features :
|
|
|
|
{{< codenew file="admin/resource/limit-range-pod-1.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/limit-range-pod-1.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
|
Create the `busybox1` Pod :
|
|
|
|
Create the `busybox1` Pod:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-range-pod-1.yaml -n limitrange-demo
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-range-pod-1.yaml -n limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
### Container spec with valid CPU/Memory requests and limits
|
|
|
|
### Container spec with valid CPU/Memory requests and limits
|
|
|
|
View the `busybox-cnt01` resource configuration
|
|
|
|
|
|
|
|
|
|
|
|
View the `busybox-cnt01` resource configuration:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[0].resources"
|
|
|
|
kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[0].resources"
|
|
|
@@ -184,13 +182,14 @@ kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[2].re
|
|
|
|
- `99Mi <= 200Mi <= 1Gi` , The container memory limit (200Mi) falls inside the authorized Memory limit range.
|
|
|
|
- `99Mi <= 200Mi <= 1Gi` , The container memory limit (200Mi) falls inside the authorized Memory limit range.
|
|
|
|
- No request/limits ratio set , thus the container is valid and created.
|
|
|
|
- No request/limits ratio set , thus the container is valid and created.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### Container spec with no CPU/Memory requests/limits
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
View the `busybox-cnt04` resource configuration:
|
|
|
|
|
|
|
|
|
|
|
|
### Container spec with no CPU/Memory requests/limits
|
|
|
|
|
|
|
|
View the `busybox-cnt04` resource configuration
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[3].resources"
|
|
|
|
kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[3].resources"
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
```json
|
|
|
|
```json
|
|
|
|
{
|
|
|
|
{
|
|
|
|
"limits": {
|
|
|
|
"limits": {
|
|
|
@@ -215,19 +214,24 @@ kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[3].re
|
|
|
|
All containers defined in the `busybox` Pod passed LimitRange validations, this the Pod is valid and create in the namespace.
|
|
|
|
All containers defined in the `busybox` Pod passed LimitRange validations, this the Pod is valid and create in the namespace.
|
|
|
|
|
|
|
|
|
|
|
|
## Limiting Pod compute resources
|
|
|
|
## Limiting Pod compute resources
|
|
|
|
|
|
|
|
|
|
|
|
The following section discusses how to constrain resources at Pod level.
|
|
|
|
The following section discusses how to constrain resources at Pod level.
|
|
|
|
|
|
|
|
|
|
|
|
{{< codenew file="admin/resource/limit-mem-cpu-pod.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/limit-mem-cpu-pod.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
|
Without having to delete `busybox1` Pod, create the `limit-mem-cpu-pod` LimitRange in the `limitrange-demo` namespace
|
|
|
|
Without having to delete `busybox1` Pod, create the `limit-mem-cpu-pod` LimitRange in the `limitrange-demo` namespace:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-mem-cpu-pod.yaml -n limitrange-demo
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-mem-cpu-pod.yaml -n limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
The limitrange is created and limits CPU to 2 Core and Memory to 2Gi per Pod.
|
|
|
|
The limitrange is created and limits CPU to 2 Core and Memory to 2Gi per Pod:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
limitrange/limit-mem-cpu-per-pod created
|
|
|
|
limitrange/limit-mem-cpu-per-pod created
|
|
|
|
```
|
|
|
|
```
|
|
|
|
Describe the `limit-mem-cpu-per-pod` limit object using the following kubectl command
|
|
|
|
|
|
|
|
|
|
|
|
Describe the `limit-mem-cpu-per-pod` limit object using the following kubectl command:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl describe limitrange/limit-mem-cpu-per-pod
|
|
|
|
kubectl describe limitrange/limit-mem-cpu-per-pod
|
|
|
|
```
|
|
|
|
```
|
|
|
@@ -240,14 +244,17 @@ Type Resource Min Max Default Request Default Limit Max Limit/Reques
|
|
|
|
Pod cpu - 2 - - -
|
|
|
|
Pod cpu - 2 - - -
|
|
|
|
Pod memory - 2Gi - - -
|
|
|
|
Pod memory - 2Gi - - -
|
|
|
|
```
|
|
|
|
```
|
|
|
|
Now create the `busybox2` Pod.
|
|
|
|
|
|
|
|
|
|
|
|
Now create the `busybox2` Pod:
|
|
|
|
|
|
|
|
|
|
|
|
{{< codenew file="admin/resource/limit-range-pod-2.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/limit-range-pod-2.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-range-pod-2.yaml -n limitrange-demo
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-range-pod-2.yaml -n limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
The `busybox2` Pod definition is identical to `busybox1` but an error is reported since Pod's resources are now limited
|
|
|
|
|
|
|
|
|
|
|
|
The `busybox2` Pod definition is identical to `busybox1` but an error is reported since Pod's resources are now limited:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
Error from server (Forbidden): error when creating "limit-range-pod-2.yaml": pods "busybox2" is forbidden: [maximum cpu usage per Pod is 2, but limit is 2400m., maximum memory usage per Pod is 2Gi, but limit is 2306867200.]
|
|
|
|
Error from server (Forbidden): error when creating "limit-range-pod-2.yaml": pods "busybox2" is forbidden: [maximum cpu usage per Pod is 2, but limit is 2400m., maximum memory usage per Pod is 2Gi, but limit is 2306867200.]
|
|
|
|
```
|
|
|
|
```
|
|
|
@@ -259,17 +266,17 @@ kubectl get po/busybox1 -n limitrange-demo -o json | jq ".spec.containers[].re
|
|
|
|
"200Mi"
|
|
|
|
"200Mi"
|
|
|
|
"900Mi"
|
|
|
|
"900Mi"
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
`busybox2` Pod will not be admitted on the cluster since the total memory limit of its container is greater than the limit defined in the LimitRange.
|
|
|
|
`busybox2` Pod will not be admitted on the cluster since the total memory limit of its container is greater than the limit defined in the LimitRange.
|
|
|
|
`busybox1` will not be evicted since it was created and admitted on the cluster before the LimitRange creation.
|
|
|
|
`busybox1` will not be evicted since it was created and admitted on the cluster before the LimitRange creation.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Limiting Storage resources
|
|
|
|
## Limiting Storage resources
|
|
|
|
|
|
|
|
|
|
|
|
You can enforce minimum and maximum size of [storage resources](/docs/concepts/storage/persistent-volumes/) that can be requested by each PersistentVolumeClaim in a namespace using a LimitRange.
|
|
|
|
You can enforce minimum and maximum size of [storage resources](/docs/concepts/storage/persistent-volumes/) that can be requested by each PersistentVolumeClaim in a namespace using a LimitRange:
|
|
|
|
|
|
|
|
|
|
|
|
{{< codenew file="admin/resource/storagelimits.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/storagelimits.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
|
Apply the YAML using `kubectl create`.
|
|
|
|
Apply the YAML using `kubectl create`:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl create -f https://k8s.io/examples/admin/resource/storagelimits.yaml -n limitrange-demo
|
|
|
|
kubectl create -f https://k8s.io/examples/admin/resource/storagelimits.yaml -n limitrange-demo
|
|
|
@@ -278,12 +285,14 @@ kubectl create -f https://k8s.io/examples/admin/resource/storagelimits.yaml -n l
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
limitrange/storagelimits created
|
|
|
|
limitrange/storagelimits created
|
|
|
|
```
|
|
|
|
```
|
|
|
|
Describe the created object,
|
|
|
|
|
|
|
|
|
|
|
|
Describe the created object:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl describe limits/storagelimits
|
|
|
|
kubectl describe limits/storagelimits
|
|
|
|
```
|
|
|
|
```
|
|
|
|
the output should look like
|
|
|
|
|
|
|
|
|
|
|
|
The output should look like:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
Name: storagelimits
|
|
|
|
Name: storagelimits
|
|
|
@@ -299,13 +308,13 @@ PersistentVolumeClaim storage 1Gi 2Gi - - -
|
|
|
|
kubectl create -f https://k8s.io/examples/admin/resource//pvc-limit-lower.yaml -n limitrange-demo
|
|
|
|
kubectl create -f https://k8s.io/examples/admin/resource//pvc-limit-lower.yaml -n limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
While creating a PVC with `requests.storage` lower than the Min value in the LimitRange, an Error thrown by the server
|
|
|
|
While creating a PVC with `requests.storage` lower than the Min value in the LimitRange, an Error thrown by the server:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
Error from server (Forbidden): error when creating "pvc-limit-lower.yaml": persistentvolumeclaims "pvc-limit-lower" is forbidden: minimum storage usage per PersistentVolumeClaim is 1Gi, but request is 500Mi.
|
|
|
|
Error from server (Forbidden): error when creating "pvc-limit-lower.yaml": persistentvolumeclaims "pvc-limit-lower" is forbidden: minimum storage usage per PersistentVolumeClaim is 1Gi, but request is 500Mi.
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
Same behaviour is noted if the `requests.storage` is greater than the Max value in the LimitRange
|
|
|
|
Same behaviour is noted if the `requests.storage` is greater than the Max value in the LimitRange:
|
|
|
|
|
|
|
|
|
|
|
|
{{< codenew file="admin/resource/pvc-limit-greater.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/pvc-limit-greater.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
@@ -321,7 +330,7 @@ Error from server (Forbidden): error when creating "pvc-limit-greater.yaml": per
|
|
|
|
|
|
|
|
|
|
|
|
If `LimitRangeItem.maxLimitRequestRatio` if specified in th `LimitRangeSpec`, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value
|
|
|
|
If `LimitRangeItem.maxLimitRequestRatio` if specified in th `LimitRangeSpec`, the named resource must have a request and limit that are both non-zero where limit divided by request is less than or equal to the enumerated value
|
|
|
|
|
|
|
|
|
|
|
|
the following `LimitRange` enforces memory limit to be at most twice the amount of the memory request for any pod in the namespace.
|
|
|
|
The following `LimitRange` enforces memory limit to be at most twice the amount of the memory request for any pod in the namespace.
|
|
|
|
|
|
|
|
|
|
|
|
{{< codenew file="admin/resource/limit-memory-ratio-pod.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/limit-memory-ratio-pod.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
@@ -343,30 +352,28 @@ Type Resource Min Max Default Request Default Limit Max Limit/Reques
|
|
|
|
Pod memory - - - - 2
|
|
|
|
Pod memory - - - - 2
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Let's create a pod with `requests.memory=100Mi` and `limits.memory=300Mi`:
|
|
|
|
|
|
|
|
|
|
|
|
Let's create a pod with `requests.memory=100Mi` and `limits.memory=300Mi`
|
|
|
|
|
|
|
|
{{< codenew file="admin/resource/limit-range-pod-3.yaml" >}}
|
|
|
|
{{< codenew file="admin/resource/limit-range-pod-3.yaml" >}}
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-range-pod-3.yaml
|
|
|
|
kubectl apply -f https://k8s.io/examples/admin/resource/limit-range-pod-3.yaml
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
The pod creation failed as the ratio here (`3`) is greater than the enforced limit (`2`) in `limit-memory-ratio-pod` LimitRange
|
|
|
|
The pod creation failed as the ratio here (`3`) is greater than the enforced limit (`2`) in `limit-memory-ratio-pod` LimitRange
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
Error from server (Forbidden): error when creating "limit-range-pod-3.yaml": pods "busybox3" is forbidden: memory max limit to request ratio per Pod is 2, but provided ratio is 3.000000.
|
|
|
|
Error from server (Forbidden): error when creating "limit-range-pod-3.yaml": pods "busybox3" is forbidden: memory max limit to request ratio per Pod is 2, but provided ratio is 3.000000.
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
### Clean up
|
|
|
|
### Clean up
|
|
|
|
Delete the `limitrange-demo` namespace to free all resources
|
|
|
|
|
|
|
|
|
|
|
|
Delete the `limitrange-demo` namespace to free all resources:
|
|
|
|
|
|
|
|
|
|
|
|
```shell
|
|
|
|
```shell
|
|
|
|
kubectl delete ns limitrange-demo
|
|
|
|
kubectl delete ns limitrange-demo
|
|
|
|
```
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
## Examples
|
|
|
|
## Examples
|
|
|
|
|
|
|
|
|
|
|
|
- See [a tutorial on how to limit compute resources per namespace](/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace/) .
|
|
|
|
- See [a tutorial on how to limit compute resources per namespace](/docs/tasks/administer-cluster/manage-resources/cpu-constraint-namespace/) .
|
|
|
|