Restrict resource consumption with limit ranges

You can use limit ranges to restrict resource consumption for specific objects in a project.

By default, containers run with unbounded compute resources on an OpenShift Container Platform cluster.

You can configure resource consumption for the following objects:

pods and containers: You can set minimum and maximum requirements for CPU and memory for pods and their containers.
Image streams: You can set limits on the number of images and tags in an ImageStream object.
Images: You can limit the size of images that can be pushed to an internal registry.
Persistent volume claims (PVC): You can restrict the size of the PVCs that can be requested.

If a pod does not meet the constraints imposed by the limit range, the pod cannot be created in the namespace.

About limit ranges

You can set specific resource limits for a pod, container, image, image stream, or persistent volume claim (PVC) in a specific project by defining a LimitRange object. A limit range allows you to restrict resource consumption in that project.

All requests to create and modify resources are evaluated against each LimitRange object in the project. If the resource violates any of the enumerated constraints, the resource is rejected.

The following shows a limit range object for all components: pod, container, image, image stream, or PVC. You can configure limits for any or all of these components in the same object. You create a different limit range object for each project where you want to control resources.

Sample limit range object for a container

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: "Container"
      max:
        cpu: "2"
        memory: "1Gi"
      min:
        cpu: "100m"
        memory: "4Mi"
      default:
        cpu: "300m"
        memory: "200Mi"
      defaultRequest:
        cpu: "200m"
        memory: "100Mi"
      maxLimitRequestRatio:
        cpu: "10"

About component limits

Review the following examples to learn the limit range parameters for each component for when you create or edit a LimitRange object.

The examples are broken out for clarity. You can create a single LimitRange object for any or all components as necessary.

Container limits

A limit range allows you to specify the minimum and maximum CPU and memory that each container in a pod can request for a specific project. If a container is created in the project, the container CPU and memory requests in the Pod spec must comply with the values set in the LimitRange object. If not, the pod does not get created. The following requirements must hold true:

The container CPU or memory request and limit must be greater than or equal to the min resource constraint for containers that are specified in the LimitRange object.
The container CPU or memory request and limit must be less than or equal to the max resource constraint for containers that are specified in the LimitRange object.

If the LimitRange object defines a max CPU, you do not need to define a CPU request value in the Pod spec. But you must specify a CPU limit value that satisfies the maximum CPU constraint specified in the limit range. The following requirements must hold true:

The ratio of the container limits to requests must be less than or equal to the maxLimitRequestRatio value for containers that is specified in the LimitRange object.

If the LimitRange object defines a maxLimitRequestRatio constraint, any new containers must have both a request and a limit value. OpenShift Container Platform calculates the limit-to-request ratio by dividing the limit by the request. This value should be a non-negative integer greater than 1.

For example, if a container has cpu: 500 in the limit value, and cpu: 100 in the request value, the limit-to-request ratio for cpu is 5. This ratio must be less than or equal to the maxLimitRequestRatio.

If the Pod spec does not specify a container resource memory or limit, the default or defaultRequest CPU and memory values for containers specified in the limit range object are assigned to the container.

Container LimitRange object definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: "Container"
      max:
        cpu: "2"
        memory: "1Gi"
      min:
        cpu: "100m"
        memory: "4Mi"
      default:
        cpu: "300m"
        memory: "200Mi"
      defaultRequest:
        cpu: "200m"
        memory: "100Mi"
      maxLimitRequestRatio:
        cpu: "10"

where:

metadata.name

Specifies the name of the limit range object.

spec.limit.max.cpu

Specifies the maximum amount of CPU that a single container in a pod can request.

spec.limit.max.memory

Specifies the maximum amount of memory that a single container in a pod can request.

spec.limit.min.cpu

Specifies the minimum amount of CPU that a single container in a pod can request.

spec.limit.min.memory

Specifies the minimum amount of memory that a single container in a pod can request.

spec.limit.default.cpu

Specifies the default amount of CPU that a container can use if not specified in the Pod spec.

spec.limit.default.memory

Specifies the default amount of memory that a container can use if not specified in the Pod spec.

spec.limit.defaultRequest.cpu

Specifies the default amount of CPU that a container can request if not specified in the Pod spec.

spec.limit.defaultRequest.memory

Specifies the default amount of memory that a container can request if not specified in the Pod spec.

spec.limit.maxLimitRequestRatio.cpu

Specifies the maximum limit-to-request ratio for a container.

Pod limits

A limit range allows you to specify the minimum and maximum CPU and memory limits for all containers across a pod in a given project. To create a container in the project, the container CPU and memory requests in the Pod spec must comply with the values set in the LimitRange object. If not, the pod does not get created.

Across all containers in a pod, the following requirements must hold true:

The container CPU or memory request and limit must be greater than or equal to the min resource constraints for pods that are specified in the LimitRange object.
The container CPU or memory request and limit must be less than or equal to the max resource constraints for pods that are specified in the LimitRange object.
The ratio of the container limits to requests must be less than or equal to the maxLimitRequestRatio constraint specified in the LimitRange object.

Pod LimitRange object definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: "Pod"
      max:
        cpu: "2"
        memory: "1Gi"
      min:
        cpu: "200m"
        memory: "6Mi"
      maxLimitRequestRatio:
        cpu: "10"

where:

metadata.name

Specifies the name of the limit range object.

spec.limit.max.cpu

Specifies the maximum amount of CPU that a pod can request across all containers.

spec.limit.max.memory

Specifies the maximum amount of memory that a pod can request across all containers.

spec.limit.min.cpu

Specifies the minimum amount of CPU that a pod can request across all containers.

spec.limit.min.memory

Specifies the minimum amount of memory that a pod can request across all containers.

spec.limit.maxLimitRequestRatio.cpu

Specifies the maximum limit-to-request ratio for a container.

Image limits

A limit range allows you to specify the maximum size of an image that can be pushed to an OpenShift image registry.

When pushing images to an OpenShift image registry, the following requirement must hold true:

The size of the image must be less than or equal to the max size for images that is specified in the LimitRange object.

Image LimitRange object definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: openshift.io/Image
      max:
        storage: 1Gi

where:

metadata.name

Specifies the name of the limit range object.

spec.limit.max.storage

Specifies the maximum size of an image that can be pushed to an OpenShift image registry.

Note

To prevent blobs that exceed the limit from being uploaded to the registry, the registry must be configured to enforce quotas.

Warning

The image size is not always available in the manifest of an uploaded image. This is especially the case for images built with Docker 1.10 or higher and pushed to a v2 registry. If such an image is pulled with an older Docker daemon, the image manifest is converted by the registry to schema v1 lacking all the size information. No storage limit set on images prevent it from being uploaded.

The issue is being addressed.

Image stream limits

A limit range allows you to specify limits for image streams.

For each image stream, the following requirements must hold true:

The count of unique references derived from imagestream.spec.tags must be less than or equal to the openshift.io/image-tags constraint in the LimitRange object.
The count of unique image identities recorded in imagestream.status.tags must be less than or equal to the openshift.io/images constraint in the LimitRange object.

Important

The names openshift.io/image-tags and openshift.io/images do not mean a maximum number of tag names versus a maximum number of images per tag. The first limit applies to tag definitions and their references in the ImageStream spec.tags resource. The second applies to distinct resolved images (typically by digest) recorded in the ImageStream status.tags resource. Creating or updating tags, including by pushing to the OpenShift image registry, can be rejected if it would exceed either limit.

Imagestream LimitRange object definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: openshift.io/ImageStream
      max:
        openshift.io/image-tags: 20
        openshift.io/images: 30

where

metadata.name

Specifies the name of the LimitRange object.

spec.limit.max.openshift.io/image-tags

Specifies the maximum number of unique references counted from tag definitions in imagestream.spec.tags.

spec.limit.max.openshift.io/images

Specifies the maximum number of unique image identities (image names equal to the digest) recorded in imagestream.status.tags.

The openshift.io/image-tags limit counts unique references from entries in imagestream.spec.tags. A reference can be an ImageStreamTag, ImageStreamImage, or DockerImage. You can add tag definitions with oc tag or oc import-image. Internal and external references are treated the same, and each unique reference in the spec is counted once. If an update would raise the count above the limit, the request is rejected, including when the update is caused by a push to the OpenShift image registry.

The openshift.io/images limit counts unique image identities in imagestream.status.tags and limits how many distinct images an image stream can hold in status. Internal and external references are not distinguished.

Persistent volume claim limits

A limit range allows you to restrict the storage requested in a persistent volume claim (PVC).

Across all persistent volume claims in a project, the following requirements must hold true:

The resource request in a persistent volume claim (PVC) must be greater than or equal the min constraint for PVCs that is specified in the LimitRange object.
The resource request in a persistent volume claim (PVC) must be less than or equal the max constraint for PVCs that is specified in the LimitRange object.

PVC LimitRange object definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: "PersistentVolumeClaim"
      min:
        storage: "2Gi"
      max:
        storage: "50Gi"

where:

metadata.name

Specifies the name of the LimitRange object.

spec.limit.min.storage

Specifies the minimum amount of storage that can be requested in a persistent volume claim.

spec.limit.max.storage

Specifies the maximum amount of storage that can be requested in a persistent volume claim.

Creating a Limit Range

You can define LimitRange objects to set specific resource limits for a pod, container, image, image stream, or persistent volume claim (PVC) in a specific project. A limit range allows you to restrict resource consumption in that project.

Procedure

Create a LimitRange object with your required specifications:
yaml
```
apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "resource-limits"
spec:
  limits:
    - type: "Pod"
      max:
        cpu: "2"
        memory: "1Gi"
      min:
        cpu: "200m"
        memory: "6Mi"
    - type: "Container"
      max:
        cpu: "2"
        memory: "1Gi"
      min:
        cpu: "100m"
        memory: "4Mi"
      default:
        cpu: "300m"
        memory: "200Mi"
      defaultRequest:
        cpu: "200m"
        memory: "100Mi"
      maxLimitRequestRatio:
        cpu: "10"
    - type: openshift.io/Image
      max:
        storage: 1Gi
    - type: openshift.io/ImageStream
      max:
        openshift.io/image-tags: 20
        openshift.io/images: 30
    - type: "PersistentVolumeClaim"
      min:
        storage: "2Gi"
      max:
        storage: "50Gi"
```
where:
metadata.name
Specifies a name for the LimitRange object.
spec.limit.type.Pod
Specifies limits for a pod, specify the minimum and maximum CPU and memory requests as needed.
spec.limit.type.Container
Specifies limits for a container, specify the minimum and maximum CPU and memory requests as needed.
spec.limit.type.default
For a container, specifies the default amount of CPU or memory that a container can use, if not specified in the Pod spec. This parameter is optional.
spec.limit.type.defaultRequest
For a container, specifies the default amount of CPU or memory that a container can request, if not specified in the Pod spec. This parameter is optional.
spec.limit.type.maxLimitRequestRatio
For a container, specifies the maximum limit-to-request ratio that can be specified in the Pod spec. This parameter is optional.
spec.limit.type.openshift.io/Image
Specifies limits for an image object. Set the maximum size of an image that can be pushed to an OpenShift image registry.
spec.limit.type.openshift.io/ImageStream
Specifies limits for an image stream: openshift.io/image-tags caps unique references from spec.tags, and openshift.io/images caps unique images recorded in status.tags.
spec.limit.type.openshift.io/PersistentVolueClaim
Specifies limits for a persistent volume claim. Set the minimum and maximum amount of storage that can be requested.
Create the object:
terminal
```
$ oc create -f <limit_range_file> -n <project>
```
where:
<limit_range_file>
Specifies the name of the YAML file you created.
<project>
Specifies the project where you want the limits to apply.

Viewing a limit

You can view the limits defined in a project by navigating in the web console to the project’s Quota page. This allows you to see details about each of the limit ranges in a project.

You can also use the CLI to view limit range details:

Procedure

Get the list of LimitRange objects defined in the project. For example, for a project called demoproject:

terminal

$ oc get limits -n demoproject

terminal

NAME              CREATED AT
resource-limits   2020-07-15T17:14:23Z

Describe the LimitRange object you are interested in, for example the resource-limits limit range:

terminal

$ oc describe limits resource-limits -n demoproject

terminal

Name:                           resource-limits
Namespace:                      demoproject
Type                            Resource                Min     Max     Default Request Default Limit   Max Limit/Request Ratio
----                            --------                ---     ---     --------------- -------------   -----------------------
Pod                             cpu                     200m    2       -               -               -
Pod                             memory                  6Mi     1Gi     -               -               -
Container                       cpu                     100m    2       200m            300m            10
Container                       memory                  4Mi     1Gi     100Mi           200Mi           -
openshift.io/Image              storage                 -       1Gi     -               -               -
openshift.io/ImageStream        openshift.io/image      -       12      -               -               -
openshift.io/ImageStream        openshift.io/image-tags -       10      -               -               -
PersistentVolumeClaim           storage                 -       50Gi    -               -               -

Deleting a Limit Range

You can remove any active LimitRange object so that it no longer enforces the limits in a project.

Procedure

Run the following command:
terminal
```
$ oc delete limits <limit_name>
```

Restrict resource consumption with limit ranges¶

About limit ranges¶

About component limits¶

Creating a Limit Range¶

Viewing a limit¶

Deleting a Limit Range¶

Restrict resource consumption with limit ranges

About limit ranges

About component limits

Creating a Limit Range

Viewing a limit

Deleting a Limit Range