# Configure Minimum and Maximum CPU Constraints for a Namespace

Configure Minimum and Maximum CPU Constraints for a NamespaceDefine a range of valid CPU resource limits for a namespace, so that every new Pod in that namespace falls within the range you configure.This page shows how to set minimum and maximum values for the CPU resources used by containers and Pods in a namespace. You specify minimum and maximum CPU values in a LimitRange object. If a Pod does not meet the constraints imposed by the LimitRange, it cannot be created in the namespace.Before you beginYou need to have a Kubernetes cluster, and the kubectl command-line tool must be configured to communicate with your cluster. It is recommended to run this tutorial on a cluster with at least two nodes that are not acting as control plane hosts. If you do not already have a cluster, you can create one by using minikube or you can use one of these Kubernetes playgrounds:iximiuz LabsKillercodaKodeKloudPlay with KubernetesYou must have access to create namespaces in your cluster.Each node in your cluster must have at least 1.0 CPU available for Pods. See meaning of CPU to learn what Kubernetes means by “1 CPU”.Create a namespaceCreate a namespace so that the resources you create in this exercise are isolated from the rest of your cluster.kubectl create namespace constraints-cpu-example Create a LimitRange and a PodHere's a manifest for an example LimitRange:admin/resource/cpu-constraints.yaml apiVersion: v1 kind: LimitRange metadata: name: cpu-min-max-demo-lr spec: limits: - max: cpu: "800m" min: cpu: "200m" type: Container Create the LimitRange:kubectl apply -f https://k8s.io/examples/admin/resource/cpu-constraints.yaml --namespace=constraints-cpu-example View detailed information about the LimitRange:kubectl get limitrange cpu-min-max-demo-lr --output=yaml --namespace=constraints-cpu-example The output shows the minimum and maximum CPU constraints as expected. But notice that even though you didn't specify default values in the configuration file for the LimitRange, they were created automatically.limits: - default: cpu: 800m defaultRequest: cpu: 800m max: cpu: 800m min: cpu: 200m type: Container Now whenever you create a Pod in the constraints-cpu-example namespace (or some other client of the Kubernetes API creates an equivalent Pod), Kubernetes performs these steps:If any container in that Pod does not specify its own CPU request and limit, the control plane assigns the default CPU request and limit to that container.Verify that every container in that Pod specifies a CPU request that is greater than or equal to 200 millicpu.Verify that every container in that Pod specifies a CPU limit that is less than or equal to 800 millicpu.Note:When creating a LimitRange object, you can specify limits on huge-pages or GPUs as well. However, when both default and defaultRequest are specified on these resources, the two values must be the same.Here's a manifest for a Pod that has one container. The container manifest specifies a CPU request of 500 millicpu and a CPU limit of 800 millicpu. These satisfy the minimum and maximum CPU constraints imposed by the LimitRange for this namespace.admin/resource/cpu-constraints-pod.yaml apiVersion: v1 kind: Pod metadata: name: constraints-cpu-demo spec: containers: - name: constraints-cpu-demo-ctr image: nginx resources: limits: cpu: "800m" requests: cpu: "500m" Create the Pod:kubectl apply -f https://k8s.io/examples/admin/resource/cpu-constraints-pod.yaml --namespace=constraints-cpu-example Verify that the Pod is running and that its container is healthy:kubectl get pod constraints-cpu-demo --namespace=constraints-cpu-example View detailed information about the Pod:kubectl get pod constraints-cpu-demo --output=yaml --namespace=constraints-cpu-example The output shows that the Pod's only container has a CPU request of 500 millicpu and CPU limit of 800 millicpu. These satisfy the constraints imposed by the LimitRange.resources: limits: cpu: 800m requests: cpu: 500m Delete the Podkubectl delete pod constraints-cpu-demo --namespace=constraints-cpu-example Attempt to create a Pod that exceeds the maximum CPU constraintHere's a manifest for a Pod that has one container. The container specifies a CPU request of 500 millicpu and a cpu limit of 1.5 cpu.admin/resource/cpu-constraints-pod-2.yaml apiVersion: v1 kind: Pod metadata: name: constraints-cpu-demo-2 spec: containers: - name: constraints-cpu-demo-2-ctr image: nginx resources: limits: cpu: "1.5" requests: cpu: "500m" Attempt to create the Pod:kubectl apply -f https://k8s.io/examples/admin/resource/cpu-constraints-pod-2.yaml --namespace=constraints-cpu-example The output shows that the Pod does not get created, because it defines an unacceptable container. That container is not acceptable because it specifies a CPU limit that is too large:Error from server (Forbidden): error when creating "examples/admin/resource/cpu-constraints-pod-2.yaml": pods "constraints-cpu-demo-2" is forbidden: maximum cpu usage per Container is 800m, but limit is 1500m. Attempt to create a Pod that does not meet the minimum CPU requestHere's a manifest for a Pod that has one container. The container specifies a CPU request of 100 millicpu and a CPU limit of 800 millicpu.admin/resource/cpu-constraints-pod-3.yaml apiVersion: v1 kind: Pod metadata: name: constraints-cpu-demo-3 spec: containers: - name: constraints-cpu-demo-3-ctr image: nginx resources: limits: cpu: "800m" requests: cpu: "100m" Attempt to create the Pod:kubectl apply -f https://k8s.io/examples/admin/resource/cpu-constraints-pod-3.yaml --namespace=constraints-cpu-example The output shows that the Pod does not get created, because it defines an unacceptable container. That container is not acceptable because it specifies a CPU request that is lower than the enforced minimum:Error from server (Forbidden): error when creating "examples/admin/resource/cpu-constraints-pod-3.yaml": pods "constraints-cpu-demo-3" is forbidden: minimum cpu usage per Container is 200m, but request is 100m. Create a Pod that does not specify any CPU request or limitHere's a manifest for a Pod that has one container. The container does not specify a CPU request, nor does it specify a CPU limit.admin/resource/cpu-constraints-pod-4.yaml apiVersion: v1 kind: Pod metadata: name: constraints-cpu-demo-4 spec: containers: - name: constraints-cpu-demo-4-ctr image: vish/stress Create the Pod:kubectl apply -f https://k8s.io/examples/admin/resource/cpu-constraints-pod-4.yaml --namespace=constraints-cpu-example View detailed information about the Pod:kubectl get pod constraints-cpu-demo-4 --namespace=constraints-cpu-example --output=yaml The output shows that the Pod's single container has a CPU request of 800 millicpu and a CPU limit of 800 millicpu. How did that container get those values?resources: limits: cpu: 800m requests: cpu: 800m Because that container did not specify its own CPU request and limit, the control plane applied the default CPU request and limit from the LimitRange for this namespace.At this point, your Pod may or may not be running. Recall that a prerequisite for this task is that your Nodes must have at least 1 CPU available for use. If each of your Nodes has only 1 CPU, then there might not be enough allocatable CPU on any Node to accommodate a request of 800 millicpu. If you happen to be using Nodes with 2 CPU, then you probably have enough CPU to accommodate the 800 millicpu request.Delete your Pod:kubectl delete pod constraints-cpu-demo-4 --namespace=constraints-cpu-example Enforcement of minimum and maximum CPU constraintsThe maximum and minimum CPU constraints imposed on a namespace by a LimitRange are enforced only when a Pod is created or updated. If you change the LimitRange, it does not affect Pods that were created previously.Motivation for minimum and maximum CPU constraintsAs a cluster administrator, you might want to impose restrictions on the CPU resources that Pods can use. For example:Each Node in a cluster has 2 CPU. You do not want to accept any Pod that requests more than 2 CPU, because no Node in the cluster can support the request.A cluster is shared by your production and development departments. You want to allow production workloads to consume up to 3 CPU, but you want development workloads to be limited to 1 CPU. You create separate namespaces for production and development, and you apply CPU constraints to each namespace.Clean upDelete your namespace:kubectl delete namespace constraints-cpu-example What's nextFor cluster administratorsConfigure Default Memory Requests and Limits for a NamespaceConfigure Default CPU Requests and Limits for a NamespaceConfigure Minimum and Maximum Memory Constraints for a NamespaceConfigure Memory and CPU Quotas for a NamespaceConfigure a Pod Quota for a NamespaceConfigure Quotas for API ObjectsFor app developersAssign Memory Resources to Containers and PodsAssign CPU Resources to Containers and PodsAssign Pod-level CPU and memory resourcesConfigure Quality of Service for Pods