Resource Tuning

Set requests and limits, and use taints, so small nodes stay stable under load.

On small or edge hardware, one greedy Pod can starve the whole node. Two Kubernetes features keep things stable.

Requests and limits

  • requests — the resources a Pod is guaranteed; used by the scheduler to place it.
  • limits — the ceiling a Pod may not exceed; protects the node.

Protecting the control plane

On multi-node clusters, add a taint to server nodes so only system Pods run there, keeping the API responsive.

Example

Example · yaml
apiVersion: v1
kind: Pod
metadata:
  name: sized-app
spec:
  containers:
    - name: app
      image: nginx:1.27
      resources:
        requests:
          cpu: "100m"
          memory: "64Mi"
        limits:
          cpu: "500m"
          memory: "128Mi"

When to use it

  • An operator sets CPU and memory limits on every pod in a 512 MB Raspberry Pi cluster so a runaway process cannot starve the k3s agent.
  • A team configures LimitRange in the production namespace to automatically apply default resource requests when developers forget to set them.
  • An SRE taints two nodes with high-memory workload labels and uses tolerations so only batch processing pods land on those nodes.

More examples

Set resource requests and limits

Defines CPU and memory requests/limits so the scheduler places the pod correctly and OOM kills are contained.

Example · yaml
containers:
- name: api
  image: myapp:v1
  resources:
    requests:
      cpu: '100m'
      memory: '128Mi'
    limits:
      cpu: '500m'
      memory: '256Mi'

Apply a LimitRange to a namespace

Creates a LimitRange so any pod without explicit resources gets sensible defaults injected automatically.

Example · yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: defaults
  namespace: apps
spec:
  limits:
  - type: Container
    default:
      cpu: '200m'
      memory: '128Mi'
    defaultRequest:
      cpu: '50m'
      memory: '64Mi'

Taint a node and add toleration

Taints a node to repel ordinary pods, then shows how a toleration in the pod spec allows batch jobs to schedule there.

Example · bash
kubectl taint node worker-02 workload=batch:NoSchedule
# In the pod spec:
# tolerations:
# - key: workload
#   value: batch
#   effect: NoSchedule
kubectl describe node worker-02 | grep Taints

Related

k3s securityk3s edge iot

Discussion

  • Be the first to comment on this lesson.