Lab Solution Resource Limits

In this lesson you will inspect and fix resource requests and limits for pods in Kubernetes. The lab sequence:

Inspect the rabbit pod to find its CPU request, then delete the pod.
Inspect the elephant pod to discover why it is failing.
Increase the elephant pod memory limit and recreate it so it runs.
Clean up by deleting the pod when finished.

Task 1 — Identify CPU request on the rabbit pod

Inspect the rabbit pod to determine its CPU request:

kubectl describe pod rabbit

Relevant excerpt from the describe output:

Limits:
  cpu: 2
Requests:
  cpu: 1

The CPU request for the rabbit pod is 1 CPU. To remove the rabbit pod:

kubectl delete pod rabbit

Task 2 — Why is the elephant pod not running?

Describe the elephant pod to find why it is failing:

kubectl describe pod elephant

Relevant excerpt showing the container state and resource configuration:

Containers:
  mem-stress:
    Image:          polinux/stress
    Command:
      stress
    Args:
      --vm
      1
      --vm-bytes
      15M
      --vm-hang
      1
    State:           Waiting
      Reason:        CrashLoopBackOff
    Last State:      Terminated
      Reason:        OOMKilled
      Exit Code:     1
    Limits:
      memory:        10Mi
    Requests:
      memory:        5Mi

Diagnosis:

The container was OOMKilled (last state), which means it exceeded its memory limit.
The container is configured to allocate 15M (--vm-bytes 15M), but the pod’s memory limit is 10Mi. This mismatch causes the OOMKill.

Action required:

Increase the memory limit so it is larger than the memory the container will allocate. For safety, set the limit to at least 20Mi.

Task 3 — Update the elephant pod’s memory limit to 20Mi

Important: pod fields such as resource limits are effectively immutable after pod creation. Using kubectl edit pod to change resource limits will usually fail with an error like:

kubectl edit pod elephant

You might try to change the manifest to:

spec:
  containers:
  - name: mem-stress
    image: polinux/stress
    command:
    - stress
    args:
    - --vm
    - "1"
    - --vm-bytes
    - 15M
    - --vm-hang
    - "1"
    resources:
      limits:
        memory: 20Mi
      requests:
        memory: 5Mi

But saving the edit can return:

# pods "elephant" was not valid:
# * spec: Forbidden: pod updates may not change fields other than `spec.containers[*].image`, `spec.initContainers[*].image`, `spec.activeDeadlineSeconds`, `spec.tolerations` (only additions to existing tolerations) or `spec.terminationGracePeriodSeconds`

Pods are mostly immutable. To change fields like resource limits, export the pod manifest, modify it offline, then recreate the pod (delete and re-create or use kubectl replace --force -f <file>).

Recommended procedure

Export the existing pod manifest to a file (or save the temporary file from kubectl edit) and modify the resources block so limits contain memory: 20Mi.
- Example filename: /tmp/elephant-pod.yaml
Replace the pod using a forced replace, which deletes and recreates the pod with the new manifest:

kubectl replace --force -f /tmp/elephant-pod.yaml

Example output:

pod "elephant" deleted
pod/elephant replaced

Verify the pod is running:

kubectl get pods

Example output:

NAME        READY   STATUS    RESTARTS   AGE
elephant    1/1     Running   0          8s

Confirm the memory limit is now 20Mi:

kubectl describe pod elephant

Relevant excerpt:

Limits:
  memory:            20Mi
Requests:
  memory:            5Mi
State:               Running
Ready:               True
Restart Count:       0

The pod is now running with the updated memory limit.

Task 4 — Clean up

When finished, delete the elephant pod:

kubectl delete pod elephant

Example output:

pod "elephant" deleted

Quick reference: common kubectl commands used

Action	Command	Notes / Expected output
Describe a pod	`kubectl describe pod <pod-name>`	Shows resource requests/limits and container state
Delete a pod	`kubectl delete pod <pod-name>`	Removes the pod; controllers may recreate it if managed
Export pod manifest	`kubectl get pod <pod-name> -o yaml > /tmp/pod.yaml`	Save current manifest to modify
Replace (force)	`kubectl replace --force -f /tmp/pod.yaml`	Deletes and recreates the pod with the new spec
List pods	`kubectl get pods`	Check status and readiness

Summary

Inspected the rabbit pod and confirmed its CPU request was 1 CPU, then deleted the pod.
Diagnosed the elephant pod failure: OOMKilled due to a container allocating 15M while the pod limit was 10Mi.
Updated the pod by editing its manifest and using kubectl replace --force to recreate the pod with memory: 20Mi.
Verified the pod runs and cleaned up.

Links and references

Introduction

Overview of Cloud Native Security

Kubernetes Cluster Component Security

Kubernetes Security Fundamentals

Kubernetes Threat Model

Platform Security

Compliance and Security Frameworks

Lab Solution Resource Limits

Task 1 — Identify CPU request on the rabbit pod

Task 2 — Why is the elephant pod not running?

Task 3 — Update the elephant pod’s memory limit to 20Mi

Task 4 — Clean up

Quick reference: common kubectl commands used

Summary

Watch Video

​Task 1 — Identify CPU request on the rabbit pod

​Task 2 — Why is the elephant pod not running?

​Task 3 — Update the elephant pod’s memory limit to 20Mi

​Task 4 — Clean up

​Quick reference: common kubectl commands used

​Summary

Watch Video

Task 1 — Identify CPU request on the rabbit pod

Task 2 — Why is the elephant pod not running?

Task 3 — Update the elephant pod’s memory limit to 20Mi

Task 4 — Clean up

Quick reference: common kubectl commands used

Summary