1.25 Kubernetes Resource Policy Definition
Kubernetes Resource Policy Definition sets rules for managing and allocating cluster resources efficiently and securely.
Kubernetes Resource Policy Definition is the precise characterization of the objects that govern resource consumption at the namespace level, ResourceQuotas and LimitRanges, defined as constraints applied above the level of any individual workload, restricting aggregate consumption and setting defaults independently of what any single Pod's own specification declares.
ResourceQuota Defined as an Aggregate Ceiling
A Namespace-Wide Total, Not a Per-Pod Limit
A ResourceQuota is defined by the scope at which it operates: it caps the total sum of a resource, such as CPU or memory requests, across every object of a given type within a namespace, rather than constraining any single object individually.
Rejection at Admission Time
A ResourceQuota is defined to take effect through admission control: a request to create or update an object that would cause the namespace's aggregate consumption to exceed its quota is rejected outright, rather than being allowed and reconciled after the fact.
LimitRange Defined as a Per-Object Default and Bound
Filling Gaps Left by Unspecified Values
A LimitRange is defined specifically to address objects that omit their own resource requests or limits, supplying default values automatically so that such objects do not enter the cluster entirely unconstrained.
Enforcing Minimum and Maximum Bounds
Beyond supplying defaults, a LimitRange is defined to enforce a minimum and maximum permissible value for resource requests and limits on individual objects within its namespace, rejecting any object whose explicitly specified values fall outside that range.
Distinguishing the Two by What They Constrain
Aggregate vs. Individual
The defining distinction between a ResourceQuota and a LimitRange is the level at which each operates: a ResourceQuota constrains the sum across all objects in a namespace, while a LimitRange constrains and defaults values on each individual object considered on its own.
Independent, Complementary Mechanisms
Because they operate at different levels, the two are defined to function independently and complementarily; a namespace can have a LimitRange without a ResourceQuota, a ResourceQuota without a LimitRange, or both simultaneously, with neither mechanism substituting for the other.
What These Policies Do Not Cover
Not a Scheduling Guarantee
Neither a ResourceQuota nor a LimitRange is defined to guarantee that a scheduled Pod will actually receive the resources it requests at runtime; they govern what may be declared and accepted into the namespace, not the scheduler's subsequent placement decisions or a node's actual runtime enforcement of those declared values.
Not a Cross-Namespace Mechanism
Both are defined to operate strictly within the boundary of a single namespace; neither mechanism constrains or is aware of resource consumption occurring in any other namespace within the same cluster.