xDev Asia

Resource requests vs limits (CPU, Memory). QoS classes: Guaranteed, Burstable, BestEffort. LimitRange defaults và ResourceQuota namespace limits.

Resource Requests, Limits và QoS Classes — Guaranteed, Burstable, BestEffort

1. Requests vs Limits

resources:
  requests:
    cpu: "250m"      # 250 millicores = 0.25 CPU (scheduling)
    memory: "128Mi"  # Minimum guaranteed memory
  limits:
    cpu: "500m"      # Max CPU (throttled but not killed)
    memory: "256Mi"  # Max memory (killed if exceeded → OOMKilled)

Resource	Khi vượt requests	Khi vượt limits
CPU	Chạy bình thường (burst)	Bị throttled (chậm lại, không kill)
Memory	Chạy bình thường	Container bị kill → OOMKilled

CPU units:
  1 CPU = 1000m (millicores)
  0.5 CPU = 500m
  100m = 0.1 CPU

Memory units:
  Ki (Kibibyte) = 1024 bytes
  Mi (Mebibyte) = 1024 Ki
  Gi (Gibibyte) = 1024 Mi
  (NOT KB/MB/GB which are decimal)

2. QoS Classes

QoS = Quality of Service (kiểm soát eviction priority)

┌─────────────────────────────────────────────────────────┐
│  GUARANTEED — Last to evict                             │
│  ✓ CPU requests == CPU limits                           │
│  ✓ Memory requests == Memory limits                     │
│  ✓ ALL containers in pod must satisfy                   │
├─────────────────────────────────────────────────────────┤
│  BURSTABLE — Middle priority                            │
│  ✓ At least one container has requests OR limits        │
│  ✗ Doesn't meet Guaranteed criteria                     │
├─────────────────────────────────────────────────────────┤
│  BESTEFFORT — First to evict                            │
│  ✗ NO requests, NO limits set at all                    │
└─────────────────────────────────────────────────────────┘

QoS Class	Điều kiện	Eviction priority
Guaranteed	requests == limits cho CPU và Memory (tất cả containers)	Thấp nhất (last evicted)
Burstable	Ít nhất một container có request/limit, không đủ Guaranteed	Trung bình
BestEffort	Không có bất kỳ request/limit nào	Cao nhất (first evicted)

Exam tip: Kiểm tra QoS class của pod: kubectl describe pod <name> | grep -i qos hoặc kubectl get pod <name> -o jsonpath='{.status.qosClass}'. Để đạt Guaranteed: set requests = limits cho CẢ CPU lẫn memory, trong CẢ containers (kể cả init containers).

3. LimitRange

LimitRange đặt default requests/limits cho Pods trong namespace — áp dụng khi Pod không tự set.

apiVersion: v1
kind: LimitRange
metadata:
  name: mem-limit-range
  namespace: development
spec:
  limits:
  - type: Container
    default:          # Default limits (khi container không set limits)
      memory: 512Mi
      cpu: 500m
    defaultRequest:   # Default requests (khi container không set requests)
      memory: 256Mi
      cpu: 250m
    max:              # Maximum allowed limits
      memory: 1Gi
      cpu: "1"
    min:              # Minimum required requests
      memory: 64Mi
      cpu: 50m

4. ResourceQuota

apiVersion: v1
kind: ResourceQuota
metadata:
  name: production-quota
  namespace: production
spec:
  hard:
    # Compute resources
    requests.cpu: "10"
    requests.memory: 20Gi
    limits.cpu: "20"
    limits.memory: 40Gi
    # Object counts
    pods: "50"
    services: "20"
    persistentvolumeclaims: "10"
    secrets: "30"
    configmaps: "30"

Exam tip: Nếu namespace có ResourceQuota yêu cầu resource limits, thì tất cả Pods trong namespace đó PHẢI set resource requests và limits — hoặc phải có LimitRange cung cấp defaults. Nếu không set, API server sẽ reject Pod creation.

5. Cheat Sheet

Tình huống	Giải pháp
Container bị OOMKilled	Tăng `limits.memory`
Container bị throttled (chậm)	Tăng `limits.cpu`
Pod không schedule được	Giảm `requests` hoặc scale cluster
QoS là Guaranteed	`requests == limits` cho CPU và Memory
Set default limits cho namespace	LimitRange
Giới hạn tổng resource của namespace	ResourceQuota

6. Practice Questions

Q1: A container has cpu requests=200m, cpu limits=500m, memory requests=256Mi, memory limits=256Mi. What is the QoS class of this Pod (assuming it's the only container)?

A) Guaranteed
B) Burstable ✓
C) BestEffort
D) Critical

Explanation: For Guaranteed, all requests must equal limits. Here cpu requests (200m) ≠ cpu limits (500m). Memory requests do equal limits (256Mi). Since the criteria for Guaranteed is not fully met, but resources are set, the class is Burstable.

Q2: A container's memory usage exceeds its memory limit. What happens?

A) The container is throttled (slowed down)
B) The container is terminated and restarted (OOMKilled) ✓
C) The container is evicted from the node
D) The Pod is rescheduled to a different node

Explanation: Unlike CPU (which is compressible — throttled but not killed), memory is incompressible. When a container exceeds its memory limit, it receives an OOMKilled exit code and is restarted by the container runtime. Repeated OOMKills lead to CrashLoopBackOff.

Q3: A namespace has a ResourceQuota requiring limits.memory to be set on all Pods. A new Pod is created without any resource limits. What happens?

A) The Pod starts with no limits (ResourceQuota applies only to running Pods)
B) The Pod is rejected by the API server unless a LimitRange provides defaults ✓
C) The Pod starts with default limits of 512Mi
D) The ResourceQuota is automatically updated to exclude this Pod