Chapter 14. Setting Limit Ranges

14.1. Overview

A limit range, defined by a LimitRange object, enumerates compute resource constraints in a project at the pod, container, image and image stream level, and specifies the amount of resources that a pod, container, image or image stream can consume.

All resource create and modification requests are evaluated against each LimitRange object in the project. If the resource violates any of the enumerated constraints, then the resource is rejected. If the resource does not set an explicit value, and if the constraint supports a default value, then the default value is applied to the resource.

Example 14.1. Limit Range Object Definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "core-resource-limits" 1
spec:
  limits:
    - type: "Pod"
      max:
        cpu: "2" 2
        memory: "1Gi" 3
      min:
        cpu: "200m" 4
        memory: "6Mi" 5
    - type: "Container"
      max:
        cpu: "2" 6
        memory: "1Gi" 7
      min:
        cpu: "100m" 8
        memory: "4Mi" 9
      default:
        cpu: "300m" 10
        memory: "200Mi" 11
      defaultRequest:
        cpu: "200m" 12
        memory: "100Mi" 13
      maxLimitRequestRatio:
        cpu: "10" 14

1: The name of the limit range object.
2: The maximum amount of CPU that a pod can request on a node across all containers.
3: The maximum amount of memory that a pod can request on a node across all containers.
4: The minimum amount of CPU that a pod can request on a node across all containers.
5: The minimum amount of memory that a pod can request on a node across all containers.
6: The maximum amount of CPU that a single container in a pod can request.
7: The maximum amount of memory that a single container in a pod can request.
8: The minimum amount of CPU that a single container in a pod can request.
9: The minimum amount of memory that a single container in a pod can request.
10: The default amount of CPU that a container will be limited to use if not specified.
11: The default amount of memory that a container will be limited to use if not specified.
12: The default amount of CPU that a container will request to use if not specified.
13: The default amount of memory that a container will request to use if not specified.
14: The maximum amount of CPU burst that a container can make as a ratio of its limit over request.

Example 14.2. OpenShift Container Platform Limit Range Object Definition

apiVersion: "v1"
kind: "LimitRange"
metadata:
  name: "openshift-resource-limits"
spec:
  limits:
    - type: openshift.io/Image
      max:
        storage: 1Gi 1
    - type: openshift.io/ImageStream
      max:
        openshift.io/image-tags: 20 2
        openshift.io/images: 30 3

1: The maximum size of an image that can be pushed to an internal registry.
2: The maximum number of unique image tags per image stream’s spec.
3: The maximum number of unique image references per image stream’s status.

Both core and OpenShift Container Platform resources can be specified in just one limit range object. They are separated here into two examples for clarity.

14.1.1. Container Limits

Supported Resources:

CPU
Memory

Supported Constraints:

Per container, the following must hold true if specified:

Table 14.1. Container
Constraint	Behavior
`Min`	`Min[resource]` less than or equal to `container.resources.requests[resource]` (required) less than or equal to `container/resources.limits[resource]` (optional) If the configuration defines a `min` CPU, then the request value must be greater than the CPU value. A limit value does not need to be specified.
`Max`	`container.resources.limits[resource]` (required) less than or equal to `Max[resource]` If the configuration defines a `max` CPU, then you do not need to define a request value, but a limit value does need to be set that satisfies the maximum CPU constraint.
`MaxLimitRequestRatio`	`MaxLimitRequestRatio[resource]` less than or equal to ( `container.resources.limits[resource]` / `container.resources.requests[resource]`) If a configuration defines a `maxLimitRequestRatio` value, then any new containers must have both a request and limit value. Additionally, OpenShift Container Platform calculates a limit to request ratio by dividing the limit by the request. This value should be a non-negative integer greater than 1. For example, if a container has `cpu: 500` in the `limit` value, and `cpu: 100` in the `request` value, then its limit to request ratio for `cpu` is `5`. This ratio must be less than or equal to the `maxLimitRequestRatio`.

Supported Defaults:

Default[resource]: Defaults container.resources.limit[resource] to specified value if none.
Default Requests[resource]: Defaults container.resources.requests[resource] to specified value if none.

14.1.2. Pod Limits

Supported Resources:

CPU
Memory

Supported Constraints:

Across all containers in a pod, the following must hold true:

Table 14.2. Pod
Constraint	Enforced Behavior
`Min`	`Min[resource]` less than or equal to `container.resources.requests[resource]` (required) less than or equal to `container.resources.limits[resource]` (optional)
`Max`	`container.resources.limits[resource]` (required) less than or equal to `Max[resource]`
`MaxLimitRequestRatio`	`MaxLimitRequestRatio[resource]` less than or equal to ( `container.resources.limits[resource]` / `container.resources.requests[resource]`)

14.1.3. Image Limits

Supported Resources:

Storage

Resource type name:

openshift.io/Image

Per image, the following must hold true if specified:

Table 14.3. Image
Constraint	Behavior
`Max`	`image.dockerimagemetadata.size` less than or equal to `Max[resource]`

Note

To prevent blobs exceeding the limit from being uploaded to the registry, the registry must be configured to enforce quota. An environment variable REGISTRY_MIDDLEWARE_REPOSITORY_OPENSHIFT_ENFORCEQUOTA must be set to true which is done by default for new deployments. To update older deployment configuration, refer to Enforcing quota in the Registry.

Warning

The image size is not always available in the manifest of an uploaded image. This is especially the case for images built with Docker 1.10 or higher and pushed to a v2 registry. If such an image is pulled with an older Docker daemon, the image manifest will be converted by the registry to schema 1 lacking all the size information. No storage limit set on images will prevent it from being uploaded.

The issue is being addressed.

14.1.4. Image Stream Limits

Supported Resources:

openshift.io/image-tags
openshift.io/images

Resource type name:

openshift.io/ImageStream

Per image stream, the following must hold true if specified:

Table 14.4. ImageStream
Constraint	Behavior
`Max[openshift.io/image-tags]`	`length( uniqueimagetags( imagestream.spec.tags ) )` less than or equal to `Max[openshift.io/image-tags]` `uniqueimagetags` returns unique references to images of given spec tags.
`Max[openshift.io/images]`	`length( uniqueimages( imagestream.status.tags ) )` less than or equal to `Max[openshift.io/images]` `uniqueimages` returns unique image names found in status tags. The name equals image’s digest.

14.1.4.1. Counting of Image References

Resource openshift.io/image-tags represents unique image references. Possible references are an ImageStreamTag, an ImageStreamImage and a DockerImage. They may be created using commands oc tag and oc import-image or by using tag tracking. No distinction is made between internal and external references. However, each unique reference tagged in the image stream’s specification is counted just once. It does not restrict pushes to an internal container registry in any way, but is useful for tag restriction.

Resource openshift.io/images represents unique image names recorded in image stream status. It allows for restriction of a number of images that can be pushed to the internal registry. Internal and external references are not distinguished.

14.2. Creating a Limit Range

To apply a limit range to a project, create a limit range object definition on your file system to your desired specifications, then run:

$ oc create -f <limit_range_file> -n <project>

14.3. Viewing Limits

You can view any limit ranges defined in a project by navigating in the web console to the project’s Quota page.

You can also use the CLI to view limit range details:

First, get the list of limit ranges defined in the project. For example, for a project called demoproject:
```
$ oc get limits -n demoproject
NAME              AGE
resource-limits   6d
```

Then, describe the limit range you are interested in, for example the resource-limits limit range:

$ oc describe limits resource-limits -n demoproject
Name:                           resource-limits
Namespace:                      demoproject
Type                            Resource                Min     Max     Default Request Default Limit   Max Limit/Request Ratio
----                            --------                ---     ---     --------------- -------------   -----------------------
Pod                             cpu                     200m    2       -               -               -
Pod                             memory                  6Mi     1Gi     -               -               -
Container                       cpu                     100m    2       200m            300m            10
Container                       memory                  4Mi     1Gi     100Mi           200Mi           -
openshift.io/Image              storage                 -       1Gi     -               -               -
openshift.io/ImageStream        openshift.io/image      -       12      -               -               -
openshift.io/ImageStream        openshift.io/image-tags -       10      -               -               -

14.4. Deleting Limits

Remove any active limit range to no longer enforce the limits of a project:

$ oc delete limits <limit_name>

此内容没有您所选择的语言版本。

14.1. Overview

14.1.1. Container Limits

14.1.2. Pod Limits

14.1.3. Image Limits

14.1.4. Image Stream Limits

14.1.4.1. Counting of Image References

14.2. Creating a Limit Range

14.3. Viewing Limits

14.4. Deleting Limits

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Red Hat legal and privacy links

Red Hat legal and privacy links