L10. Resource Limits, Quotas and LimitRanges

Why Resource Limits Matter for Security

Resource limits are not just an operational concern. They are a security control. Without limits, a compromised pod can:

• Crypto-mine: Consume all CPU on the node
• DoS other pods: Starve co-located workloads of memory
• Trigger OOM kills: Force the kernel to kill other pods
• Exhaust disk: Fill the node's ephemeral storage with logs or data

Requests vs Limits

containers:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">name: app</li>
</ul>
    resources:
      requests:
        cpu: 100m
        memory: 128Mi
      limits:
        cpu: 500m
        memory: 256Mi

requests tell the scheduler how much capacity the pod needs. limits tell the kubelet the maximum the container can use. If a container exceeds its memory limit, it is OOM-killed. If it exceeds its CPU limit, it is throttled.

ResourceQuotas

ResourceQuotas set aggregate limits for an entire namespace:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: production
spec:
  hard:
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    pods: "50"
    secrets: "20"
    services.loadbalancers: "2"

When a ResourceQuota is active, every pod must specify resource requests and limits. Pods without them are rejected. Best practice: Set quotas on every non-system namespace to prevent resource exhaustion from a single team or workload.

LimitRanges

LimitRanges set default, minimum, and maximum resource values for containers in a namespace. They catch pods that forget to set limits:

apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: production
spec:
  limits:
<ul class="list-disc pl-6 mb-4 space-y-2">
<li class="text-slate-300">type: Container</li>
</ul>
      default:
        cpu: 200m
        memory: 256Mi
      defaultRequest:
        cpu: 100m
        memory: 128Mi
      max:
        cpu: "2"
        memory: 2Gi
      min:
        cpu: 50m
        memory: 64Mi

If a pod does not specify resource limits, the LimitRange injects the default values. If a pod requests more than the maximum, it is rejected.

Ephemeral Storage Limits

Do not forget ephemeral storage. Containers can fill the node's disk with logs, temp files, or downloaded data:

resources:
  requests:
    ephemeral-storage: 500Mi
  limits:
    ephemeral-storage: 1Gi

When a container exceeds its ephemeral storage limit, it is evicted from the node.

Priority Classes

Use PriorityClasses to ensure critical workloads survive resource pressure. Higher-priority pods can preempt lower-priority ones when the cluster is under pressure:

apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: security-critical
value: 1000000
globalDefault: false
description: "Priority for security monitoring workloads"

Assign the priority class to pods that must keep running (security agents, logging, monitoring).