Enforcing Resource Limits at the Namespace Level in Kubernetes

Introduction

In multi-tenant Kubernetes clusters, enforcing resource limits at the namespace level is crucial to prevent excessive resource consumption by certain workloads. This ensures fair resource distribution, avoids overloading nodes, and enhances cluster stability.

In this blog, we will cover:

• The ResourceQuota concept.
• How to apply a ResourceQuota to enforce CPU and memory limits.
• A real-world use case demonstrating resource control in a shared environment.

Understanding ResourceQuota

A ResourceQuota restricts the total resource consumption within a namespace. It applies to CPU, memory, storage, and even object counts (e.g., pods, services, PVCs).

Example: Enforcing CPU and Memory Limits

To ensure that no pod in my-namespace exceeds 4 CPUs and 8Gi of RAM, create a ResourceQuota as follows:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: namespace-quota
  namespace: my-namespace
spec:
  hard:
    requests.cpu: "2"
    requests.memory: "4Gi"
    limits.cpu: "4"
    limits.memory: "8Gi"

Breaking Down the Configuration:

• requests.cpu & requests.memory: Ensures pods collectively request no more than 2 CPUs and 4Gi memory.
• limits.cpu & limits.memory: Prevents the namespace from using more than 4 CPUs and 8Gi memory.

Apply this quota to the cluster:

kubectl apply -f resource-quota.yaml

Verify the applied quota:

kubectl get resourcequota -n my-namespace

Real-World Scenario: Multi-Tenant Cluster Resource Management

Problem:

A company runs multiple applications in a shared Kubernetes cluster, where different teams deploy workloads in separate namespaces. One team accidentally deploys an unoptimized pod that consumes excessive CPU and memory, causing performance degradation for others.

Solution:

1. Define Resource Quotas for Each NamespaceapiVersion: v1 kind: ResourceQuota metadata: name: team-a-quota namespace: team-a spec: hard: requests.cpu: "1" requests.memory: "2Gi" limits.cpu: "2" limits.memory: "4Gi"
2. Apply the Quota for Each Team’s Namespacekubectl apply -f team-a-quota.yaml kubectl apply -f team-b-quota.yaml
3. Monitor Resource Consumptionkubectl describe resourcequota -n team-aThis command shows the current usage against the set quota.

Best Practices for Namespace Resource Management

• Set realistic quotas based on historical usage and application needs.
• Use LimitRanges to enforce per-pod constraints within a namespace.
• Monitor resource usage regularly with Kubernetes metrics (kubectl top pods and kubectl top nodes).
• Adjust quotas dynamically based on scaling needs.

Conclusion

ResourceQuota provides an efficient way to manage resource allocation in a Kubernetes namespace. By enforcing CPU and memory limits, organizations can ensure fair resource distribution and prevent accidental overuse, keeping the cluster stable and performant.

Would you like to explore per-pod resource limits using LimitRange? Let us know in the comments!