Agent Wranglers

INF-79Required

Set resource requests and a memory limit on every container

Give every container a CPU and memory request from measured use, and a memory limit. Set a default in each namespace, so a container without them is refused or gets one.

By Agent Wranglers. Updated .

How to do it

The scheduler places pods by their requests. A pod without one can land on a full node and starve its neighbours. A container that passes its memory limit is killed and restarted. Without a limit, a leak takes memory from every pod on the node. Set the memory request near the measured peak, and the limit at about the same value, so the node never runs out. Many teams leave the CPU limit out, because CPU throttling slows requests while spare CPU sits idle. Set a LimitRange per namespace for defaults and a ResourceQuota for the namespace total. The autoscaler's CPU target is a share of the request, so requests also drive Scale on the resource that runs out. Size the runtime's heap below the limit, as Size the runtime's memory to the box says. Hosts without Kubernetes follow Set limits on memory and processes.

Examples

YAML example

resources:
  requests: { cpu: 250m, memory: 384Mi }
  limits: { memory: 384Mi }
---
apiVersion: v1
kind: LimitRange
metadata: { name: defaults, namespace: shop }
spec:
  limits:
    - type: Container
      defaultRequest: { cpu: 100m, memory: 128Mi }
      default: { memory: 256Mi }

How to check

A policy check on the manifests fails any container without a CPU request, a memory request and a memory limit. Every namespace has a LimitRange. The count of containers killed for running out of memory over the last 7 days is 0, or each one has a ticket.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/containers-and-orchestration/kubernetes-requests-and-limits">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.