Skip to content

Room 09

RESOURCE LIMITS

The Resource Vault

  • Resources are finite in the cluster. Every container must declare what it needs.
  • A pod is stuck in Pending because its resource requests exceed node capacity. Fix it!

📜 Mission Briefing

  1. Apply greedy-pod.yaml - it requests 100 CPU cores and will be stuck in Pending.
  2. Use kubectl describe pod greedy-pod to find the scheduling error in Events.
  3. Edit the pod to set reasonable limits:
  4. CPU request: 100m, CPU limit: 200m
  5. Memory request: 64Mi, Memory limit: 128Mi
  6. Delete the greedy pod and apply fixed-pod.yaml with correct limits.
  7. Once running, exec into it. The file /app/password contains the password.
Key Commands
Command Purpose
kubectl describe node See allocatable resources
kubectl top nodes Node resource usage
kubectl top pods Pod resource usage
kubectl describe pod NAME See scheduling events
kubectl edit pod NAME Edit a running pod
Resource Requests & Limits
apiVersion: v1
kind: Pod
metadata:
  name: resource-demo
spec:
  containers:
    - name: app
      image: nginx:alpine
      resources:
        # Requests: guaranteed minimum resources
        requests:
          memory: "64Mi"     # 64 Mebibytes
          cpu: "250m"        # 250 millicores = 0.25 CPU
        # Limits: maximum resources allowed
        limits:
          memory: "128Mi"    # OOMKilled if exceeded
          cpu: "500m"        # Throttled if exceeded

CPU Units: - 1 = 1 full CPU core - 500m = 0.5 CPU core (500 millicores) - 100m = 0.1 CPU core

Memory Units: - Ki = Kibibytes (1024) - Mi = Mebibytes (1024²) - Gi = Gibibytes (1024³)

# Check node capacity and allocatable resources
kubectl describe node | grep -A 6 "Allocated resources"

# View resource usage (requires metrics-server)
kubectl top nodes
kubectl top pods
kubectl top pods --sort-by=memory

# QoS Classes (determined by requests/limits configuration):
# Guaranteed: requests == limits for all containers
# Burstable:  at least one container has requests < limits
# BestEffort: no requests or limits set at all

# Check QoS class
kubectl get pod NAME -o jsonpath='{.status.qosClass}'
Hints

Hint 1

Check why the greedy pod is Pending: 

kubectl describe pod greedy-pod | grep -A 5 Events

Hint 2

Delete greedy pod and apply the fixed one: 

kubectl delete pod greedy-pod
kubectl apply -f fixed-pod.yaml

Hint 3

Read the password: 

kubectl exec fixed-pod -- cat /app/password
The password is memlimit.

🔓 Unlock Room 10

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_10/README             \
        -out ../room_10/README.txt        \
        -pass pass:PASSWORD
cat ../room_10/README.txt