Utilize LimitRange to set default resources requests/limits

[maxsxu]

Motivation

We may encounter errors when deploying SNP on some platforms (like Rancher, etc.) where resources requests/limits are not set.

And we sometimes forget to set resources for certain components. So it would be helpful to use LimitRange to help us set the default resources across the board.

Referencing from https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/cpu-default-namespace/

If your namespace has a CPU resource quota configured, it is helpful to have a default value in place for CPU limit. Here are two of the restrictions that a CPU resource quota imposes on a namespace:

• For every Pod that runs in the namespace, each of its containers must have a CPU limit.
• CPU limits apply a resource reservation on the node where the Pod in question is scheduled. The total amount of CPU that is reserved for use by all Pods in the namespace must not exceed a specified limit.

When you add a LimitRange:

If any Pod in that namespace that includes a container does not specify its own CPU limit, the control plane applies the default CPU limit to that container, and the Pod can be allowed to run in a namespace that is restricted by a CPU ResourceQuota.

Referencing from https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/memory-default-namespace

If your namespace has a memory resource quota configured, it is helpful to have a default value in place for memory limit. Here are three of the restrictions that a resource quota imposes on a namespace:

• For every Pod that runs in the namespace, the Pod and each of its containers must have a memory limit. (If you specify a memory limit for every container in a Pod, Kubernetes can infer the Pod-level memory limit by adding up the limits for its containers).
• Memory limits apply a resource reservation on the node where the Pod in question is scheduled. The total amount of memory reserved for all Pods in the namespace must not exceed a specified limit.
  The total amount of memory actually used by all Pods in the namespace must also not exceed a specified limit.

When you add a LimitRange:

If any Pod in that namespace that includes a container does not specify its own memory limit, the control plane applies the default memory limit to that container, and the Pod can be allowed to run in a namespace that is restricted by a memory ResourceQuota.

How to set default CPU/Memory limits and requests ?

Just need to add a new LimitRange resource in the target namespace:

apiVersion: v1
kind: LimitRange
metadata:
  name: default-cpu-memory-resources
  namespace: app-snp
spec:
  limits:
  - default:
      cpu: 1
      memory: "500Mi"
    defaultRequest:
      cpu: 0.5
      memory: "100Mi"
    type: Container

References

• https://kubernetes.io/docs/concepts/policy/limit-range/
• https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/cpu-default-namespace/
• https://kubernetes.io/docs/tasks/administer-cluster/manage-resources/memory-default-namespace

[yuweisung]

We may need to review the rbac
https://kubernetes.io/docs/reference/kubernetes-api/policy-resources/limit-range-v1/