Set namespace quotas and default resources

Approach

A LimitRange gives containers default requests and limits when they don't set any; a ResourceQuota caps the namespace's total requests, limits and object counts.

Solution

apiVersion: v1
kind: LimitRange
metadata: {name: defaults, namespace: team-a}
spec:
  limits:
    - type: Container
      defaultRequest: {cpu: 100m, memory: 128Mi}
      default: {memory: 512Mi}
      max: {memory: 4Gi}
---
apiVersion: v1
kind: ResourceQuota
metadata: {name: team-a, namespace: team-a}
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 64Gi
    limits.memory: 96Gi
    pods: "200"
    persistentvolumeclaims: "30"

Pitfalls

• A quota on limits.cpu forces every pod to set CPU limits, which can cause throttling.
• Defaults that are far from real usage; review them with data.

Variations

• Hierarchical namespaces or a platform tool (Capsule) for many tenants.
• Report usage against quota per team.

Further reading: Resource Quotas