Skip to content

Room 40

LIMITRANGES

The Default Enforcer

  • LimitRanges set default, min, and max resource limits for containers in a namespace.
  • Pods without resource specs get the defaults automatically.

📜 Mission Briefing

  1. Apply limitrange.yaml to namespace enforced.
  2. Deploy a pod WITHOUT resource requests/limits.
  3. Describe the pod - it should have default limits applied.
  4. Verify the defaults match the LimitRange.
  5. The LimitRange annotation contains the password: limitrng.
Key Commands
Command Purpose
kubectl get limitrange -n NS List LimitRanges
kubectl describe limitrange NAME -n NS LimitRange details
How LimitRanges Work
apiVersion: v1
kind: LimitRange
metadata:
  name: container-limits
  namespace: enforced
  annotations:
    escape-password: "limitrng"
spec:
  limits:
    - type: Container
      default:               # Default limits (if not specified)
        cpu: "500m"
        memory: "256Mi"
      defaultRequest:        # Default requests (if not specified)
        cpu: "100m"
        memory: "128Mi"
      max:                   # Maximum allowed
        cpu: "2"
        memory: "1Gi"
      min:                   # Minimum allowed
        cpu: "50m"
        memory: "64Mi"
    - type: Pod
      max:
        cpu: "4"
        memory: "2Gi"
    - type: PersistentVolumeClaim
      max:
        storage: "10Gi"
      min:
        storage: "1Gi"

# LimitRange vs ResourceQuota:
# LimitRange:    Per-container/pod defaults and limits
# ResourceQuota: Total namespace resource budget

# If LimitRange sets defaults:
# Pods without requests/limits get defaults injected
# Pods exceeding max are REJECTED
# Pods below min are REJECTED

kubectl create ns enforced
kubectl apply -f limitrange.yaml -n enforced

# Deploy pod without limits
kubectl run no-limits --image=nginx -n enforced

# Check that defaults were applied
kubectl describe pod no-limits -n enforced | grep -A 5 "Limits\|Requests"
Hints

Hint 1

kubectl create ns enforced
kubectl apply -f limitrange.yaml
kubectl run test-pod --image=nginx -n enforced

Hint 2

kubectl describe pod test-pod -n enforced | grep -A2 Limits
kubectl get limitrange -n enforced -o jsonpath='{.items[0].metadata.annotations.escape-password}'

Hint 3

The password is limitrng.

🔓 Unlock Room 41

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_41/README -out ../room_41/README.txt -pass pass:PASSWORD
cat ../room_41/README.txt