--- title: Restrict resource consumption with limit ranges --- # Restrict resource consumption with limit ranges {#nodes-cluster-limit-ranges} You can use limit ranges to restrict resource consumption for specific objects in a project. By default, containers run with unbounded compute resources on an OpenShift Container Platform cluster. You can configure resource consumption for the following objects: - pods and containers: You can set minimum and maximum requirements for CPU and memory for pods and their containers. - Image streams: You can set limits on the number of images and tags in an `ImageStream` object. - Images: You can limit the size of images that can be pushed to an internal registry. - Persistent volume claims (PVC): You can restrict the size of the PVCs that can be requested. If a pod does not meet the constraints imposed by the limit range, the pod cannot be created in the namespace. ## About limit ranges {#nodes-cluster-limit-ranges-about_nodes-cluster-limit-ranges} You can set specific resource limits for a pod, container, image, image stream, or persistent volume claim (PVC) in a specific project by defining a `LimitRange` object. A limit range allows you to restrict resource consumption in that project. All requests to create and modify resources are evaluated against each `LimitRange` object in the project. If the resource violates any of the enumerated constraints, the resource is rejected. The following shows a limit range object for all components: pod, container, image, image stream, or PVC. You can configure limits for any or all of these components in the same object. You create a different limit range object for each project where you want to control resources. ```yaml {title="Sample limit range object for a container"} apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: "Container" max: cpu: "2" memory: "1Gi" min: cpu: "100m" memory: "4Mi" default: cpu: "300m" memory: "200Mi" defaultRequest: cpu: "200m" memory: "100Mi" maxLimitRequestRatio: cpu: "10" ``` ## About component limits {#nodes-cluster-limit-ranges-limits_nodes-cluster-limit-ranges} Review the following examples to learn the limit range parameters for each component for when you create or edit a `LimitRange` object. The examples are broken out for clarity. You can create a single `LimitRange` object for any or all components as necessary. Container limits : A limit range allows you to specify the minimum and maximum CPU and memory that each container in a pod can request for a specific project. If a container is created in the project, the container CPU and memory requests in the `Pod` spec must comply with the values set in the `LimitRange` object. If not, the pod does not get created. The following requirements must hold true: - The container CPU or memory request and limit must be greater than or equal to the `min` resource constraint for containers that are specified in the `LimitRange` object. - The container CPU or memory request and limit must be less than or equal to the `max` resource constraint for containers that are specified in the `LimitRange` object. If the `LimitRange` object defines a `max` CPU, you do not need to define a CPU `request` value in the `Pod` spec. But you must specify a CPU `limit` value that satisfies the maximum CPU constraint specified in the limit range. The following requirements must hold true: - The ratio of the container limits to requests must be less than or equal to the `maxLimitRequestRatio` value for containers that is specified in the `LimitRange` object. If the `LimitRange` object defines a `maxLimitRequestRatio` constraint, any new containers must have both a `request` and a `limit` value. OpenShift Container Platform calculates the limit-to-request ratio by dividing the `limit` by the `request`. This value should be a non-negative integer greater than 1. For example, if a container has `cpu: 500` in the `limit` value, and `cpu: 100` in the `request` value, the limit-to-request ratio for `cpu` is `5`. This ratio must be less than or equal to the `maxLimitRequestRatio`. If the `Pod` spec does not specify a container resource memory or limit, the `default` or `defaultRequest` CPU and memory values for containers specified in the limit range object are assigned to the container. ```yaml {title="Container LimitRange object definition"} apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: "Container" max: cpu: "2" memory: "1Gi" min: cpu: "100m" memory: "4Mi" default: cpu: "300m" memory: "200Mi" defaultRequest: cpu: "200m" memory: "100Mi" maxLimitRequestRatio: cpu: "10" ``` where: `metadata.name` : Specifies the name of the limit range object. `spec.limit.max.cpu` : Specifies the maximum amount of CPU that a single container in a pod can request. `spec.limit.max.memory` : Specifies the maximum amount of memory that a single container in a pod can request. `spec.limit.min.cpu` : Specifies the minimum amount of CPU that a single container in a pod can request. `spec.limit.min.memory` : Specifies the minimum amount of memory that a single container in a pod can request. `spec.limit.default.cpu` : Specifies the default amount of CPU that a container can use if not specified in the `Pod` spec. `spec.limit.default.memory` : Specifies the default amount of memory that a container can use if not specified in the `Pod` spec. `spec.limit.defaultRequest.cpu` : Specifies the default amount of CPU that a container can request if not specified in the `Pod` spec. `spec.limit.defaultRequest.memory` : Specifies the default amount of memory that a container can request if not specified in the `Pod` spec. `spec.limit.maxLimitRequestRatio.cpu` : Specifies the maximum limit-to-request ratio for a container. Pod limits : A limit range allows you to specify the minimum and maximum CPU and memory limits for all containers across a pod in a given project. To create a container in the project, the container CPU and memory requests in the `Pod` spec must comply with the values set in the `LimitRange` object. If not, the pod does not get created. If the `Pod` spec does not specify a container resource memory or limit, the `default` or `defaultRequest` CPU and memory values for containers specified in the limit range object are assigned to the container. Across all containers in a pod, the following requirements must hold true: - The container CPU or memory request and limit must be greater than or equal to the `min` resource constraints for pods that are specified in the `LimitRange` object. - The container CPU or memory request and limit must be less than or equal to the `max` resource constraints for pods that are specified in the `LimitRange` object. - The ratio of the container limits to requests must be less than or equal to the `maxLimitRequestRatio` constraint specified in the `LimitRange` object. ```yaml {title="Pod LimitRange object definition"} apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: "Pod" max: cpu: "2" memory: "1Gi" min: cpu: "200m" memory: "6Mi" maxLimitRequestRatio: cpu: "10" ``` where: `metadata.name` : Specifies the name of the limit range object. `spec.limit.max.cpu` : Specifies the maximum amount of CPU that a pod can request across all containers. `spec.limit.max.memory` : Specifies the maximum amount of memory that a pod can request across all containers. `spec.limit.min.cpu` : Specifies the minimum amount of CPU that a pod can request across all containers. `spec.limit.min.memory` : Specifies the minimum amount of memory that a pod can request across all containers. `spec.limit.maxLimitRequestRatio.cpu` : Specifies the maximum limit-to-request ratio for a container. Image limits : A limit range allows you to specify the maximum size of an image that can be pushed to an OpenShift image registry. When pushing images to an OpenShift image registry, the following requirement must hold true: - The size of the image must be less than or equal to the `max` size for images that is specified in the `LimitRange` object. ```yaml {title="Image LimitRange object definition"} apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: openshift.io/Image max: storage: 1Gi ``` where: `metadata.name` : Specifies the name of the limit range object. `spec.limit.max.storage` : Specifies the maximum size of an image that can be pushed to an OpenShift image registry. > [!NOTE] > To prevent blobs that exceed the limit from being uploaded to the registry, the registry must be configured to enforce quotas. > [!WARNING] > The image size is not always available in the manifest of an uploaded image. This is especially the case for images built with Docker 1.10 or higher and pushed to a v2 registry. If such an image is pulled with an older Docker daemon, the image manifest is converted by the registry to schema v1 lacking all the size information. No storage limit set on images prevent it from being uploaded. > > [The issue is being addressed.](https://github.com/openshift/origin/issues/7706) Image stream limits : A limit range allows you to specify limits for image streams. For each image stream, the following requirements must hold true: - The count of unique references derived from `imagestream.spec.tags` must be less than or equal to the `openshift.io/image-tags` constraint in the `LimitRange` object. - The count of unique image identities recorded in `imagestream.status.tags` must be less than or equal to the `openshift.io/images` constraint in the `LimitRange` object. > [!IMPORTANT] > The names `openshift.io/image-tags` and `openshift.io/images` do not mean a maximum number of tag names versus a maximum number of images per tag. The first limit applies to tag definitions and their references in the `ImageStream` `spec.tags` resource. The second applies to distinct resolved images (typically by digest) recorded in the `ImageStream` `status.tags` resource. Creating or updating tags, including by pushing to the OpenShift image registry, can be rejected if it would exceed either limit. ```yaml {title="Imagestream LimitRange object definition"} apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: openshift.io/ImageStream max: openshift.io/image-tags: 20 openshift.io/images: 30 ``` where `metadata.name` : Specifies the name of the `LimitRange` object. `spec.limit.max.openshift.io/image-tags` : Specifies the maximum number of unique references counted from tag definitions in `imagestream.spec.tags`. `spec.limit.max.openshift.io/images` : Specifies the maximum number of unique image identities (image names equal to the digest) recorded in `imagestream.status.tags`. The `openshift.io/image-tags` limit counts unique references from entries in `imagestream.spec.tags`. A reference can be an `ImageStreamTag`, `ImageStreamImage`, or `DockerImage`. You can add tag definitions with `oc tag` or `oc import-image`. Internal and external references are treated the same, and each unique reference in the spec is counted once. If an update would raise the count above the limit, the request is rejected, including when the update is caused by a push to the OpenShift image registry. The `openshift.io/images` limit counts unique image identities in `imagestream.status.tags` and limits how many distinct images an image stream can hold in status. Internal and external references are not distinguished. Persistent volume claim limits : A limit range allows you to restrict the storage requested in a persistent volume claim (PVC). Across all persistent volume claims in a project, the following requirements must hold true: - The resource request in a persistent volume claim (PVC) must be greater than or equal the `min` constraint for PVCs that is specified in the `LimitRange` object. - The resource request in a persistent volume claim (PVC) must be less than or equal the `max` constraint for PVCs that is specified in the `LimitRange` object. ```yaml {title="PVC LimitRange object definition"} apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: "PersistentVolumeClaim" min: storage: "2Gi" max: storage: "50Gi" ``` where: `metadata.name` : Specifies the name of the `LimitRange` object. `spec.limit.min.storage` : Specifies the minimum amount of storage that can be requested in a persistent volume claim. `spec.limit.max.storage` : Specifies the maximum amount of storage that can be requested in a persistent volume claim. ## Creating a Limit Range {#nodes-cluster-limit-creating_nodes-cluster-limit-ranges} You can define `LimitRange` objects to set specific resource limits for a pod, container, image, image stream, or persistent volume claim (PVC) in a specific project. A limit range allows you to restrict resource consumption in that project. **Procedure** 1. Create a `LimitRange` object with your required specifications: ```yaml apiVersion: "v1" kind: "LimitRange" metadata: name: "resource-limits" spec: limits: - type: "Pod" max: cpu: "2" memory: "1Gi" min: cpu: "200m" memory: "6Mi" - type: "Container" max: cpu: "2" memory: "1Gi" min: cpu: "100m" memory: "4Mi" default: cpu: "300m" memory: "200Mi" defaultRequest: cpu: "200m" memory: "100Mi" maxLimitRequestRatio: cpu: "10" - type: openshift.io/Image max: storage: 1Gi - type: openshift.io/ImageStream max: openshift.io/image-tags: 20 openshift.io/images: 30 - type: "PersistentVolumeClaim" min: storage: "2Gi" max: storage: "50Gi" ``` where: `metadata.name` : Specifies a name for the `LimitRange` object. `spec.limit.type.Pod` : Specifies limits for a pod, specify the minimum and maximum CPU and memory requests as needed. `spec.limit.type.Container` : Specifies limits for a container, specify the minimum and maximum CPU and memory requests as needed. `spec.limit.type.default` : For a container, specifies the default amount of CPU or memory that a container can use, if not specified in the `Pod` spec. This parameter is optional. `spec.limit.type.defaultRequest` : For a container, specifies the default amount of CPU or memory that a container can request, if not specified in the `Pod` spec. This parameter is optional. `spec.limit.type.maxLimitRequestRatio` : For a container, specifies the maximum limit-to-request ratio that can be specified in the `Pod` spec. This parameter is optional. `spec.limit.type.openshift.io/Image` : Specifies limits for an image object. Set the maximum size of an image that can be pushed to an OpenShift image registry. `spec.limit.type.openshift.io/ImageStream` : Specifies limits for an image stream: `openshift.io/image-tags` caps unique references from `spec.tags`, and `openshift.io/images` caps unique images recorded in `status.tags`. `spec.limit.type.openshift.io/PersistentVolueClaim` : Specifies limits for a persistent volume claim. Set the minimum and maximum amount of storage that can be requested. 2. Create the object: ```terminal $ oc create -f -n ``` where: `` : Specifies the name of the YAML file you created. `` : Specifies the project where you want the limits to apply. ## Viewing a limit {#nodes-cluster-limit-viewing_nodes-cluster-limit-ranges} You can view the limits defined in a project by navigating in the web console to the project’s **Quota** page. This allows you to see details about each of the limit ranges in a project. You can also use the CLI to view limit range details: **Procedure** 1. Get the list of `LimitRange` objects defined in the project. For example, for a project called **demoproject**: ```terminal $ oc get limits -n demoproject ``` ```terminal NAME CREATED AT resource-limits 2020-07-15T17:14:23Z ``` 2. Describe the `LimitRange` object you are interested in, for example the `resource-limits` limit range: ```terminal $ oc describe limits resource-limits -n demoproject ``` ```terminal Name: resource-limits Namespace: demoproject Type Resource Min Max Default Request Default Limit Max Limit/Request Ratio ---- -------- --- --- --------------- ------------- ----------------------- Pod cpu 200m 2 - - - Pod memory 6Mi 1Gi - - - Container cpu 100m 2 200m 300m 10 Container memory 4Mi 1Gi 100Mi 200Mi - openshift.io/Image storage - 1Gi - - - openshift.io/ImageStream openshift.io/image - 12 - - - openshift.io/ImageStream openshift.io/image-tags - 10 - - - PersistentVolumeClaim storage - 50Gi - - - ``` ## Deleting a Limit Range {#nodes-cluster-limit-ranges-deleting_nodes-cluster-limit-ranges} You can remove any active `LimitRange` object so that it no longer enforces the limits in a project. **Procedure** - Run the following command: ```terminal $ oc delete limits ```