Rightsize Resource Requests from Metrics
Read the 95th percentile CPU and memory from metrics and set requests to p95 so pods are not throttled or over-provisioned.
Task
Configure kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi so the cluster enforces the policy at admission time instead of relying on manual review.
When to use this
A developer deploys a pod without kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi and it disrupts a node, causing evictions on a production cluster.
Prerequisites
- A Kubernetes cluster with kubectl access
- Cluster admin or namespace edit RBAC
Steps
1. Configure kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi in the project configuration file with the recommended defaults.
kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi
Expected output: The configuration is accepted and kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi runs without errors on the first invocation.
2. Run the check locally to verify kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi blocks merge on failure.
- name: Run add resource request limit rightsize
run: pnpm test
Expected output: Pull requests with failing kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512Mi are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Enforce at admission
Start by measuring the problem. Read the 95th percentile CPU and memory from metrics and set requests to p95 so pods are not throttled or over-provisioned. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run kubectl set resources deploy/api –requests=cpu=200m,memory=256Mi –limits=cpu=500m,memory=512Mi against the current codebase and inspect the output before wiring it into CI.
kubectl set resources deploy/api --requests=cpu=200m,memory=256Mi --limits=cpu=500m,memory=512MiVerify the policy
Once the gate is in place, make failures actionable. A failing kubectl set resources deploy/api –requests=cpu=200m,memory=256Mi –limits=cpu=500m,memory=512Mi should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.