LimitRanges and ResourceQuotas

Individual Pod resource settings work at the workload level. But what happens when a developer forgets to set requests? Or deploys a Pod with an unreasonably high limit? LimitRanges and ResourceQuotas enforce resource policies at the namespace level, catching problems before they affect the cluster.

LimitRange: defaults and per-container constraints

A LimitRange applies to individual containers and Pods within a namespace. It does two things:

• Sets default requests and limits for containers that do not specify any
• Enforces minimum and maximum bounds on what can be requested

nano default-limits.yaml

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: '100m'
        memory: '64Mi'
      default:
        cpu: '500m'
        memory: '128Mi'
      max:
        cpu: '2'
        memory: '1Gi'
      min:
        cpu: '50m'
        memory: '32Mi'

kubectl apply -f default-limits.yaml

Now create a Pod without any resource configuration:

kubectl run no-resources --image=busybox:1.36 --restart=Never --command -- sleep 3600
kubectl get pod no-resources -o jsonpath='{.spec.containers[0].resources}'

The output shows requests and limits filled in automatically by the LimitRange. A developer who forgot to set resources gets the defaults instead of BestEffort placement.

kubectl describe limitrange default-limits

The describe output shows the full policy in a readable table. Check the Max row: any container in this namespace that tries to set a CPU limit above 2 cores will be rejected by the API server.

ResourceQuota: total namespace consumption cap

A ResourceQuota limits the total amount of resources all Pods in a namespace can collectively consume. It also limits the total count of Kubernetes objects.

nano namespace-quota.yaml

apiVersion: v1
kind: ResourceQuota
metadata:
  name: namespace-quota
spec:
  hard:
    requests.cpu: '4'
    requests.memory: '4Gi'
    limits.cpu: '8'
    limits.memory: '8Gi'
    pods: '20'

kubectl apply -f namespace-quota.yaml

kubectl describe resourcequota namespace-quota

The output shows Used versus Hard for each constraint. As Pods are created, the Used values increment. When any Used value reaches its Hard limit, new Pods that would exceed that limit are rejected.

Checking quota usage

kubectl get resourcequota
kubectl describe resourcequota namespace-quota

The describe output is the clearest view: it shows the hard limit alongside the current usage for each resource type. When a Pod creation fails with exceeded quota, this is the first place to check.

kubectl delete limitrange default-limits
kubectl delete resourcequota namespace-quota
kubectl delete pod no-resources

LimitRanges protect individual workloads from misconfiguration. ResourceQuotas protect the cluster from namespace-level over-allocation. Use them together: the LimitRange ensures defaults so the ResourceQuota can track requests accurately. The next module covers multi-container Pods, where multiple containers share a Pod’s network and volume space.