Resource Quota Draft #793

MBishop17 · 2018-09-13T20:02:15Z

Alena, can I please get some feedback on the draft I wrote for Resource Quotas?

You can view the actual draft page at https://staging.rancher.com/docs/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/project-quotas/

alena1108 · 2018-09-13T21:37:26Z

Resource quotas in Rancher work similarly to how they do in the native version of Kubernetes.

We should mention that Rancher implementation leverages native Kubernetes Resource Quota concept.

In a standard Kubernetes deployment, resource quotas are applied to individual namespaces.
Quotas are applied to individual namespaces, rather than collectively. Even though each quota sets the same limits, a unique quota is applied to each namespace.

Even though each quota sets the same limits - We should perhaps be more clear on the use case we are trying to solve. That sometimes admin wants the same resource quota to be applied to multiple namespaces, as a part of a particular project. Also from administrator perspective, it would be nice to define the quota on the project, so every namespace created in the project would have the default resource quota set, so user doesn't have to enter it.

When the overall limit for the project is exceeded, Kubernetes uses logic to determine which namespaces to stop to get back under the quota.

Not quite true. We enforce the limit on the API level by disallowing the namespace creation if its resource quota exceeds the limit available on the project. We do not stop the existing namespaces.

If an individual namespace exceeds its namespace limit, Kubernetes stops anything objects in the namespace from operating.

Same here.

More to add:

We should describe that quota defined on the namespace will get propagated to kubernetes cluster, and Kubernetes native capabilities will enforce that all the resources created within the namespace, will be within the namespace quota. Like if user tries to start the workload which CPU request exceeds the namespace limit, the workload creation would fail.

We should emphasize that on namespace creation, if the quota defined on the namespace, exceeds the quota available on the project (considering all existing namespaces and their quotas), the namespace creation would fail. Admin would have to adjust the project quota by increasing the limit.

MBishop17 · 2018-09-14T02:16:50Z

@alena1108 and @deniseschannon , I've completed a draft for resource quotas. It's a long one, so enjoy!

alena1108 · 2018-09-14T19:44:16Z

content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md

@@ -171,4 +189,23 @@ Cluster admins and members may occasionally need to move a namespace to another

 1. Choose a new project for the new namespace and then click **Move**. Alternatively, you can remove the namespace from all projects by selecting **None**.

-**Result:** Your namespace is moved to a different project (or is unattached from all projects). If any project resources are attached to the namespace, the namespace releases them and then attached resources from the new project. 
+**Result:** Your namespace is moved to a different project (or is unattached from all projects). If any project resources are attached to the namespace, the namespace releases them and then attached resources from the new project.


we do not allow moving namespace if the destination project has the resource quota set. Thats the limitation for now. The only moves that are allowed, are:

from project with no quota, to the project with no quota

from project with quota, to the project with no quota. The quota on the namespace will be cleaned up as the result

alena1108 · 2018-09-14T19:45:14Z

content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md

+
+### Editing Namespace Resource Quotas 
+
+If there is a [resource quota]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) configured for a project, you can override the namespace default limit to provide a specific namespace with access to more (or less) project resources. 


with access to more (or less) project resources

think would be good to note that the namespace quota value should be within project limit value?

alena1108 · 2018-09-14T19:46:00Z

content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/editing-projects/_index.md

+    | Field                   | Description                                                                                              |
+    | ----------------------- | -------------------------------------------------------------------------------------------------------- |
+    | Project Limit           | The overall resource limit for the project.                                                              |
+    | Namespace Default Limit | The default resource limit available for each namespace. This limit is propagated to each namespace in the project. | 


should mention that combined limit of all the namespaces shouldn't exceed the quota set on a project

MBishop17 · 2018-09-17T21:08:22Z

related to #527

deniseschannon · 2018-09-17T21:45:51Z

content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md

@@ -106,6 +106,22 @@ Rancher extends Kubernetes to allow the application of [Pod Security Policies](h
        >**Tip:** Choose Custom to create a custom role on the fly: [Custom Project Roles]({{< baseurl >}}/rancher/v2.x/en/admin-settings/rbac/cluster-project-roles/#custom-project-roles).

    1. To add more members, repeat substeps a—c.
+
+1. **Optional:** Add **Resource Quotas**, which limit the resources that a project (and its namespaces) can consume. For more information, see [Resource Quotas]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas). 


we should indicate which version this is available in.

deniseschannon · 2018-09-17T21:47:24Z

content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/_index.md

+    >**Notes:** 
+    >
+    >- Don't move the namespaces in the `System` project. Moving these namespaces can adversely affect cluster networking.
+    >- You cannot move a namespace into a project that already has a [resource quota]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/) configured.


we should indicate that if you move a namespace that had a quota set, the quotas would be removed when moving to a project with no quota.

deniseschannon · 2018-09-18T03:13:30Z

content/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas/_index.md

+>**<sup>1</sup>** In the quota, if you set CPU or Memory limits, all containers you create in the project / namespace must explicitly satisfy the quota. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details.
+
+
+### Namespace Default Limit Overrides


I'd rename this to Overriding the default Limit for a Namespace

deniseschannon · 2018-09-19T18:24:11Z

LGTM

MBishop17 · 2018-09-20T23:41:03Z

@deniseschannon , are we waiting on anything to close out this issue?

deniseschannon · 2018-09-21T17:52:12Z

I can't merge to staging as it will cause staging to be stuck in being able to be moved to live. @MBishop17

title change

b35b151

MBishop17 self-assigned this Sep 13, 2018

MBishop17 requested a review from alena1108 September 13, 2018 20:02

MBishop17 force-pushed the quota-draft branch from 1c2033b to f411a79 Compare September 13, 2018 23:42

updates per Alena

1e7cc95

MBishop17 force-pushed the quota-draft branch from f411a79 to 1e7cc95 Compare September 14, 2018 00:16

MBishop17 added 2 commits September 13, 2018 17:40

adding procedure for enabling quotas while creating a project.

8d5eca5

completing draft of quotas

d04919b

MBishop17 force-pushed the quota-draft branch from 37a7379 to d04919b Compare September 14, 2018 02:15

MBishop17 requested a review from deniseschannon September 14, 2018 02:15

deniseschannon added this to the 2.1 Features milestone Sep 14, 2018

MBishop17 changed the title ~~title change / draft review~~ Resource Quota Draft Sep 14, 2018

alena1108 reviewed Sep 14, 2018

View reviewed changes

edits based on Alena's feedback.

2044466

deniseschannon reviewed Sep 17, 2018

View reviewed changes

deniseschannon reviewed Sep 18, 2018

View reviewed changes

adding feedback from Denise

3a89df3

MBishop17 force-pushed the quota-draft branch from 933da00 to 3a89df3 Compare September 18, 2018 05:18

deniseschannon assigned deniseschannon and unassigned MBishop17 Sep 19, 2018

deniseschannon merged commit eaf3362 into rancher:staging Sep 21, 2018

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Resource Quota Draft #793

Resource Quota Draft #793

MBishop17 commented Sep 13, 2018

alena1108 commented Sep 13, 2018 •

edited

MBishop17 commented Sep 14, 2018

alena1108 Sep 14, 2018

alena1108 Sep 14, 2018 •

edited

alena1108 Sep 14, 2018

MBishop17 commented Sep 17, 2018

deniseschannon Sep 17, 2018

deniseschannon Sep 17, 2018

deniseschannon Sep 18, 2018

deniseschannon commented Sep 19, 2018

MBishop17 commented Sep 20, 2018

deniseschannon commented Sep 21, 2018


		### Editing Namespace Resource Quotas

		If there is a [resource quota]({{< baseurl >}}/rancher/v2.x/en/k8s-in-rancher/projects-and-namespaces/resource-quotas) configured for a project, you can override the namespace default limit to provide a specific namespace with access to more (or less) project resources.

		><sup>1</sup> In the quota, if you set CPU or Memory limits, all containers you create in the project / namespace must explicitly satisfy the quota. See the [Kubernetes documentation](https://kubernetes.io/docs/concepts/policy/resource-quotas/#requests-vs-limits) for more details.


		### Namespace Default Limit Overrides

Resource Quota Draft #793

Resource Quota Draft #793

Conversation

MBishop17 commented Sep 13, 2018

alena1108 commented Sep 13, 2018 • edited

MBishop17 commented Sep 14, 2018

alena1108 Sep 14, 2018

Choose a reason for hiding this comment

alena1108 Sep 14, 2018 • edited

Choose a reason for hiding this comment

alena1108 Sep 14, 2018

Choose a reason for hiding this comment

MBishop17 commented Sep 17, 2018

deniseschannon Sep 17, 2018

Choose a reason for hiding this comment

deniseschannon Sep 17, 2018

Choose a reason for hiding this comment

deniseschannon Sep 18, 2018

Choose a reason for hiding this comment

deniseschannon commented Sep 19, 2018

MBishop17 commented Sep 20, 2018

deniseschannon commented Sep 21, 2018

alena1108 commented Sep 13, 2018 •

edited

alena1108 Sep 14, 2018 •

edited