Two lessons ago a Deployment made with kubectl create deployment was BestEffort: no requests, no limits, first to be evicted. Asking every team to remember resources on every container does not scale. A LimitRange sets the defaults for them.

Defaults

apiVersion: v1
kind: LimitRange
metadata:
  name: defaults
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: 100m
        memory: 64Mi
      default:
        cpu: 500m
        memory: 128Mi

default is the limit a container gets when it sets none; defaultRequest is the request. From now on, a Pod created in this namespace without resources arrives with these numbers written into its own spec. Pods that set their own keep them.

The Deployment's template is not changed. Only its Pods are, which is why kubectl get pod … -o yaml shows resources the template never mentioned.

Bounds

The same object can also refuse:

    - type: Container
      min:
        memory: 32Mi
      max:
        cpu: "1"
        memory: 1Gi

A container asking for limits.cpu: 2 is not created:

Error from server (Forbidden): pods "big" is forbidden: maximum cpu usage per Container is 1, but limit is 2

When a ReplicaSet runs into this, the Deployment never reaches its replica count and kubectl describe rs shows FailedCreate events with the same message.

Reading it

kubectl get limitrange
kubectl describe limitrange defaults
kubectl describe ns vitals

Type       Resource  Min  Max  Default Request  Default Limit  Max Limit/Request Ratio
----       --------  ---  ---  ---------------  -------------  -----------------------
Container  cpu       -    1    100m             500m           -
Container  memory    -    1Gi  64Mi             128Mi          -