Ravindra BagaleCourses & study guides मराठी

Chapter 76: DevOps Projects Part 6: Kubernetes Canary Helm RBAC NetworkPolicy Quotas EKS Microservices Velero Upgrade

76.5 Project 44: Resource quotas and limits per team

By Last updated:

Friends, ResourceQuota caps a namespace; LimitRange sets defaults and max per container. Today we give team-a and team-b quotas, apply LimitRange, and watch an oversized Pod fail.

What you will build in this project

  1. ResourceQuota YAML per team.
  2. LimitRange with defaults.
  3. ok Pod and rejected big Pod.
  4. describe quota output note.

1. Start from a real company story

At Swiggy in Bengaluru, one data team scheduled 40 GPU Pods and starved checkout.

Sneha added per-namespace quotas the next day. Rough past cost: about ₹45 lakh in delayed orders.

Today we practice those caps.

ResourceQuotahard capsLimitRangedefaults maxok Podadmittedbig PodForbidden
Picture 1: team-a hard CPU/mem/pods → scheduler → admit or Forbidden

Ravindra Bagale's Tip

Students set limits but forget requests. Quota on requests.cpu then ignores the Pod. Always set requests. Keep that habit.

2. Start and prepare

Step 1: Why quota LimitRange

Why: Stop noisy neighbors. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'ResourceQuota caps total CPU memory and object counts in a namespace'

You will see:

ResourceQuota caps total CPU memory and object counts in a namespace

What it means: What ResourceQuota is.

Example 2: a2

Type this:

echo 'LimitRange sets default and max request/limit for each Pod or container'

You will see:

LimitRange sets default and max request/limit for each Pod or container

What it means: What LimitRange is.

Example 3: a3

Type this:

echo 'Together they stop one team from eating the whole cluster'

You will see:

Together they stop one team from eating the whole cluster

What it means: Why both.

Step 2: Namespaces quota YAML

Why: Apply hard caps. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf quota. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

echo 'kubectl create namespace team-a; kubectl create namespace team-b'

You will see:

kubectl create namespace team-a; kubectl create namespace team-b

What it means: Two team namespaces.

Example 5: b2

Type this:

mkdir -p /tmp/k8s44 && printf '%s\n' 'apiVersion: v1' 'kind: ResourceQuota' 'metadata: {name: team-a-quota, namespace: team-a}' 'spec:' '  hard:' '    requests.cpu: "2"' '    requests.memory: 2Gi' '    limits.cpu: "4"' '    limits.memory: 4Gi' '    pods: "10"' '    services: "5"' > /tmp/k8s44/quota-a.yaml && cat /tmp/k8s44/quota-a.yaml

You will see:

kind: ResourceQuota

What it means: Quota YAML for team-a.

Example 6: b3

Type this:

echo 'kubectl apply -f /tmp/k8s44/quota-a.yaml'

You will see:

kubectl apply -f /tmp/k8s44/quota-a.yaml

What it means: Apply quota.

Step 3: LimitRange YAML

Why: Defaults and max. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf lr. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'apiVersion: v1' 'kind: LimitRange' 'metadata: {name: team-a-limits, namespace: team-a}' 'spec:' '  limits:' '  - type: Container' '    default: {cpu: 200m, memory: 256Mi}' '    defaultRequest: {cpu: 100m, memory: 128Mi}' '    max: {cpu: "1", memory: 1Gi}' > /tmp/k8s44/lr-a.yaml && cat /tmp/k8s44/lr-a.yaml

You will see:

kind: LimitRange

What it means: LimitRange with defaults and max.

Example 8: c2

Type this:

echo 'kubectl apply -f /tmp/k8s44/lr-a.yaml'

You will see:

kubectl apply -f /tmp/k8s44/lr-a.yaml

What it means: Apply LimitRange.

Example 9: c3

Type this:

echo 'Pods without requests inherit defaultRequest from LimitRange'

You will see:

Pods without requests inherit defaultRequest from LimitRange

What it means: Default tip.

3. Build the main pieces

Step 4: Describe list

Why: Inspect. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: describe. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

echo 'kubectl describe quota team-a-quota -n team-a'

You will see:

kubectl describe quota team-a-quota -n team-a

What it means: See used vs hard.

Example 11: d2

Type this:

echo 'kubectl describe limitrange team-a-limits -n team-a'

You will see:

kubectl describe limitrange team-a-limits -n team-a

What it means: See defaults and max.

Example 12: d3

Type this:

echo 'kubectl get resourcequota,limitrange -n team-a'

You will see:

kubectl get resourcequota,limitrange -n team-a

What it means: List both.

Step 5: ok vs big Pod

Why: Prove reject. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: kubectl run. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

echo 'kubectl run ok -n team-a --image=nginx:1.27-alpine --restart=Never --requests=cpu=100m,memory=128Mi'

You will see:

kubectl run ok ... --requests=cpu=100m,memory=128Mi

What it means: Fits under quota.

Example 14: e2

Type this:

echo 'kubectl run big -n team-a --image=nginx:1.27-alpine --restart=Never --requests=cpu=3 --limits=cpu=3 2>&1 | head || true'

You will see:

kubectl run big ... 2>&1 | head || true

What it means: Should fail: exceeds requests.cpu hard.

Example 15: e3

Type this:

echo 'Forbidden errors naming ResourceQuota mean the cap worked'

You will see:

Forbidden errors naming ResourceQuota mean the cap worked

What it means: Success of the fail.

Step 6: team-b quota

Why: Fairness. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: quota-b. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'apiVersion: v1' 'kind: ResourceQuota' 'metadata: {name: team-b-quota, namespace: team-b}' 'spec:' '  hard:' '    requests.cpu: "1"' '    requests.memory: 1Gi' '    pods: "5"' > /tmp/k8s44/quota-b.yaml && kubectl apply -f /tmp/k8s44/quota-b.yaml

You will see:

resourcequota/team-b-quota created

What it means: Smaller quota for team-b.

Example 17: f2

Type this:

echo 'Different teams can have different hard caps'

You will see:

Different teams can have different hard caps

What it means: Fairness tip.

Example 18: f3

Type this:

echo 'Copy the pattern into GitOps so quotas are not one-off kubectl'

You will see:

Copy the pattern into GitOps so quotas are not one-off kubectl

What it means: GitOps tip.

4. Automate and verify

Step 7: Object counts

Why: Spam caps. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: configmap. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

echo 'Count quotas: pods services configmaps secrets persistentvolumeclaims'

You will see:

Count quotas: pods services configmaps secrets persistentvolumeclaims

What it means: Object count caps.

Example 20: g2

Type this:

echo 'kubectl create configmap c1 -n team-a --from-literal=a=1'

You will see:

kubectl create configmap c1 -n team-a --from-literal=a=1

What it means: Uses object quota if set.

Example 21: g3

Type this:

echo 'Add configmaps: "20" to hard when ConfigMap spam is a risk'

You will see:

Add configmaps: "20" to hard when ConfigMap spam is a risk

What it means: Spam tip.

Step 8: Priority requests

Why: Scheduling. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo tips. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'PriorityClass and ResourceQuota together shape scheduling fairness'

You will see:

PriorityClass and ResourceQuota together shape scheduling fairness

What it means: Priority tip.

Example 23: h2

Type this:

echo 'Overcommit: limits can exceed node capacity; requests should fit'

You will see:

Overcommit: limits can exceed node capacity; requests should fit

What it means: Requests vs limits.

Example 24: h3

Type this:

echo 'Always set requests; limits without requests confuse autoscalers'

You will see:

Always set requests; limits without requests confuse autoscalers

What it means: HPA habit.

Step 9: Events process

Why: Support. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: events. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

echo 'kubectl get events -n team-a --field-selector reason=FailedCreate'

You will see:

kubectl get events -n team-a --field-selector reason=FailedCreate

What it means: Quota failure events.

Example 26: i2

Type this:

echo 'Teach teams to read describe quota before opening tickets'

You will see:

Teach teams to read describe quota before opening tickets

What it means: Support habit.

Example 27: i3

Type this:

echo 'Raise quotas with a ticket and a capacity plan, not quietly'

You will see:

Raise quotas with a ticket and a capacity plan, not quietly

What it means: Process tip.

5. Harden and accept

Step 10: Scopes explain

Why: Advanced. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: explain. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

echo 'Scope selectors can apply quotas only to PriorityClass or BestEffort Pods'

You will see:

Scope selectors can apply quotas only to PriorityClass or BestEffort Pods

What it means: Scope tip.

Example 29: j2

Type this:

echo 'kubectl explain resourcequota.spec.hard'

You will see:

kubectl explain resourcequota.spec.hard

What it means: API docs tip.

Example 30: j3

Type this:

echo 'Lab note: kind clusters are small — keep hard numbers tiny'

You will see:

Lab note: kind clusters are small — keep hard numbers tiny

What it means: Lab sizing.

Step 11: Cleanup

Why: Cleanup. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: cleanup. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

echo 'Optional cleanup: kubectl delete ns team-a team-b'

You will see:

Optional cleanup: kubectl delete ns team-a team-b

What it means: Cleanup.

Example 32: k2

Type this:

echo 'Save ResourceQuota and LimitRange YAML for both teams'

You will see:

Save ResourceQuota and LimitRange YAML for both teams

What it means: Artifact.

Example 33: k3

Type this:

echo 'Next project sketches a production EKS cluster on AWS'

You will see:

Next project sketches a production EKS cluster on AWS

What it means: Bridge.

Step 12: Acceptance

Why: Sneha signs off. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: All green. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'Quota and LimitRange applied; big Pod rejected'

You will see:

Quota and LimitRange applied; big Pod rejected

What it means: Checklist reject.

Example 35: z2

Type this:

echo 'describe quota shows used vs hard'

You will see:

describe quota shows used vs hard

What it means: Checklist describe.

Example 36: z3

Type this:

echo 'Sneha: PASS'

You will see:

Sneha: PASS

What it means: Project 44 accepted.

Check yourself

Q1. Who fixed Swiggy?

Sneha

Q2. Cap object kind?

ResourceQuota

Q3. Defaults object kind?

LimitRange

Q4. Fail signal?

Forbidden

Q5. See usage command?

kubectl describe quota

Q6. Always set?

requests

Friends, you capped two teams and proved a reject. Did you understand? Let us try it once more. Put quotas in GitOps next to the namespace manifests.

Lab: try at home

  1. Create team namespaces.
  2. Apply ResourceQuota.
  3. Apply LimitRange.
  4. Run ok and big Pods.
  5. describe used vs hard.

Recap

  • Quotas protect shared clusters.
  • LimitRange fills missing requests.
  • Object count caps matter.
  • Raise quotas with a plan.
  • Requests drive scheduling.