Manifests and limits

Plexivo Kubernetes checks every object before it reaches the cluster, from the console and from kubectl alike. Anything it cannot prove safe is refused with a message that names the field. This page lists the rules so your manifests pass the first time.

What you can create#

You can also read your namespace’s ResourceQuota and LimitRange to see the capacity it holds.

What every pod needs#

• The runtimeClassName line in the pod spec, exactly as in the example below.
• CPU and memory requests and limits on every container, with each limit equal to its request. You are billed for what pods request.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: web
spec:
  replicas: 2
  selector:
    matchLabels:
      app: web
  template:
    metadata:
      labels:
        app: web
    spec:
      runtimeClassName: kata
      containers:
        - name: web
          image: ghcr.io/acme/web:1.4.2
          ports:
            - containerPort: 8080
          resources:
            requests:
              cpu: 500m
              memory: 1Gi
            limits:
              cpu: 500m
              memory: 1Gi
---
apiVersion: v1
kind: Service
metadata:
  name: web
spec:
  selector:
    app: web
  ports:
    - port: 80
      targetPort: 8080

Add an Ingress to make it public: see Expose a service over HTTPS.

What is refused#

• Anything outside your namespace, and cluster-wide objects such as Namespace, Node, ClusterRole, StorageClass or CustomResourceDefinition.
• Replacing the namespace’s own guardrails: ResourceQuota, LimitRange, Role and RoleBinding.
• NodePort, LoadBalancer and ExternalName Services, and externalIPs. Traffic enters through an Ingress.
• Privileged containers, allowPrivilegeEscalation: true, and added Linux capabilities.
• hostNetwork, hostPID, hostIPC, hostPort and hostPath volumes.
• Volumes other than configMap, secret, emptyDir, persistentVolumeClaim, projected, downwardAPI and ephemeral.
• automountServiceAccountToken: true, a priorityClassName, and seccomp or AppArmor profiles other than RuntimeDefault.
• Wildcard Ingress hosts.

Capacity in your namespace#

Your namespace holds enough CPU and memory for the workload’s maximum pods at the size you chose. One container may not ask for more than the whole workload holds.

If a change needs more, raise the requested capacity first: see Pods and scaling.

Next steps#