Chapter 2 · Practice 5 of 5

Give each namespace a ResourceQuota and default requests

From Resource requests, limits and scaling

Why it matters

One runaway Deployment that scales to hundreds of replicas can starve every other team on the cluster. A ResourceQuota caps the total requests, limits and object counts a namespace can use, and a LimitRange fills in default requests and limits for containers that do not set them.

Both admission plugins, ResourceQuota and LimitRanger, are on by default, and the security checklist recommends keeping them enabled.

Use them together:

A LimitRange so no container lands with zero requests.
A ResourceQuota sized for the namespace's normal load plus room to scale.
An alert when a namespace nears its quota, so a blocked deploy is not the first sign.

Example

YAML

apiVersion: v1
kind: LimitRange
metadata:
  name: defaults
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: "100m"
        memory: "128Mi"
      default:
        memory: "128Mi"