Resource Tuning
Set requests and limits, and use taints, so small nodes stay stable under load.
On small or edge hardware, one greedy Pod can starve the whole node. Two Kubernetes features keep things stable.
Requests and limits
- requests — the resources a Pod is guaranteed; used by the scheduler to place it.
- limits — the ceiling a Pod may not exceed; protects the node.
Protecting the control plane
On multi-node clusters, add a taint to server nodes so only system Pods run there, keeping the API responsive.
Example
apiVersion: v1
kind: Pod
metadata:
name: sized-app
spec:
containers:
- name: app
image: nginx:1.27
resources:
requests:
cpu: "100m"
memory: "64Mi"
limits:
cpu: "500m"
memory: "128Mi"When to use it
- An operator sets CPU and memory limits on every pod in a 512 MB Raspberry Pi cluster so a runaway process cannot starve the k3s agent.
- A team configures LimitRange in the production namespace to automatically apply default resource requests when developers forget to set them.
- An SRE taints two nodes with high-memory workload labels and uses tolerations so only batch processing pods land on those nodes.
More examples
Set resource requests and limits
Defines CPU and memory requests/limits so the scheduler places the pod correctly and OOM kills are contained.
containers:
- name: api
image: myapp:v1
resources:
requests:
cpu: '100m'
memory: '128Mi'
limits:
cpu: '500m'
memory: '256Mi'Apply a LimitRange to a namespace
Creates a LimitRange so any pod without explicit resources gets sensible defaults injected automatically.
apiVersion: v1
kind: LimitRange
metadata:
name: defaults
namespace: apps
spec:
limits:
- type: Container
default:
cpu: '200m'
memory: '128Mi'
defaultRequest:
cpu: '50m'
memory: '64Mi'Taint a node and add toleration
Taints a node to repel ordinary pods, then shows how a toleration in the pod spec allows batch jobs to schedule there.
kubectl taint node worker-02 workload=batch:NoSchedule
# In the pod spec:
# tolerations:
# - key: workload
# value: batch
# effect: NoSchedule
kubectl describe node worker-02 | grep Taints
Discussion