How to fix must specify limits.cpu, limits.memory in Kubernetes

KubernetesBEGINNERMEDIUMUpdated Dec 5, 2025· 141 views

This admission error occurs when ResourceQuota or LimitRange requires containers to specify resource limits. Fix it by adding explicit limits.cpu and limits.memory to your container spec.

Quick fix

Fixes must specify limits.cpu, limits.memory

# Check ResourceQuota
kubectl get resourcequota -n <namespace>
kubectl describe resourcequota -n <namespace>

# Check LimitRange
kubectl get limitrange -n <namespace>
kubectl describe limitrange -n <namespace>
  1. Check namespace quota and limits requirements
  2. Add resource limits to pod spec
  3. Update Deployment with limits
  4. Handle multi-container pods
kubernetes — error
# Check ResourceQuota
kubectl get resourcequota -n <namespace>
kubectl describe resourcequota -n <namespace>
# Check LimitRange
kubectl get limitrange -n <namespace>
kubectl describe limitrange -n <namespace>
must specify limits.cpu, limits.memory

What this error means

The "must specify limits.cpu, limits.memory" error occurs when a namespace has ResourceQuota or LimitRange policies that require all containers to declare resource limits, but your Pod spec is missing these fields. When ResourceQuota tracks CPU/memory limits, Kubernetes requires all pods to specify explicit limits so the quota controller can accurately track namespace usage. Similarly, LimitRange can enforce that containers must have limits defined. This is an admission-time validation—the API server rejects the Pod before it's created. Adding the required limits fields to your container spec resolves the issue.

Typical symptoms

  • Pod creation fails with "must specify limits" error
  • HTTP 403 Forbidden from admission controller
  • Deployment stuck with 0 available replicas
  • Error occurs for both new pods and updated deployments
  • Works in namespaces without ResourceQuota/LimitRange

Common causes

  1. Container spec missing resources.limits section
  2. Namespace has ResourceQuota tracking limits.cpu/limits.memory
  3. LimitRange requires explicit limits without providing defaults
  4. Helm chart or template missing resource specifications
  5. Multi-container pod where one container lacks limits

How to fix "must specify limits.cpu, limits.memory"

1Check namespace quota and limits requirements

View ResourceQuota and LimitRange:

bash
# Check ResourceQuota
kubectl get resourcequota -n <namespace>
kubectl describe resourcequota -n <namespace>

# Check LimitRange
kubectl get limitrange -n <namespace>
kubectl describe limitrange -n <namespace>

If ResourceQuota has limits.cpu or limits.memory, pods must specify these.

2Add resource limits to pod spec

Add both requests and limits to your container:

yaml
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  containers:
  - name: app
    image: nginx:latest
    resources:
      requests:
        cpu: "250m"
        memory: "256Mi"
      limits:
        cpu: "500m"          # Required
        memory: "512Mi"      # Required

Apply:

bash
kubectl apply -f pod.yaml -n <namespace>
3Update Deployment with limits

Add resources to deployment template:

yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
spec:
  template:
    spec:
      containers:
      - name: app
        image: my-image
        resources:
          requests:
            cpu: "100m"
            memory: "128Mi"
          limits:
            cpu: "500m"
            memory: "512Mi"

Redeploy:

bash
kubectl apply -f deployment.yaml
kubectl rollout status deployment/my-app
4Handle multi-container pods

Each container needs its own limits:

yaml
spec:
  containers:
  - name: app
    image: myapp:v1
    resources:
      requests:
        cpu: "250m"
        memory: "256Mi"
      limits:
        cpu: "500m"
        memory: "512Mi"
  - name: sidecar
    image: sidecar:v1
    resources:
      requests:
        cpu: "50m"
        memory: "64Mi"
      limits:
        cpu: "100m"        # Sidecar also needs limits
        memory: "128Mi"
5Set up LimitRange defaults

Admin can create defaults so pods don't need explicit limits:

yaml
apiVersion: v1
kind: LimitRange
metadata:
  name: default-limits
  namespace: <namespace>
spec:
  limits:
  - type: Container
    default:
      cpu: "500m"
      memory: "512Mi"
    defaultRequest:
      cpu: "250m"
      memory: "256Mi"

After applying, pods without limits receive these defaults automatically.

6Update Helm chart values

For Helm deployments, set resources in values.yaml:

yaml
# values.yaml
resources:
  requests:
    cpu: "100m"
    memory: "128Mi"
  limits:
    cpu: "500m"
    memory: "256Mi"

Template uses these values:

yaml
# templates/deployment.yaml
resources:
  {{- toYaml .Values.resources | nindent 6 }}

Install with resources:

bash
helm upgrade --install myapp ./chart -n <namespace>

Advanced notes

QoS Classes Based on Limits:
- Guaranteed: requests = limits for all containers
- Burstable: At least one container has requests or limits
- BestEffort: No requests or limits (rejected when limits required)

CPU vs Memory Units:
- CPU: m (millicores), e.g., 500m = 0.5 cores
- Memory: Mi (mebibytes), Gi (gibibytes)

Enforcement Mechanisms:
- CPU limits: Throttled via cgroups (not killed)
- Memory limits: OOMKilled if exceeded (exit code 137)

Best Practices:
1. Set requests based on typical usage
2. Set limits based on maximum acceptable usage
3. For Guaranteed QoS: requests = limits
4. For Burstable: limits 2-4x requests (allows bursting)
5. Always set memory limits to prevent OOM affecting other pods

Limit-to-Request Ratio:
LimitRange can enforce maximum ratio:

yaml
maxLimitRequestRatio:
  cpu: "2"      # Limit can be max 2x request
  memory: "2"

Frequently asked questions

What does "must specify limits.cpu, limits.memory" mean?
memory" error occurs when a namespace has ResourceQuota or LimitRange policies that require all containers to declare resource limits, but your Pod spec is missing these fields. When ResourceQuota tracks CPU/memory limits, Kubernetes requires all pods to specify explicit limits so the quota controller can accurately track namespace usage. Similarly, LimitRange can enforce that containers must have limits defined.
How do I fix "must specify limits.cpu, limits.memory"?
This admission error occurs when ResourceQuota or LimitRange requires containers to specify resource limits. Fix it by adding explicit limits.cpu and limits.memory to your container spec.
What causes "must specify limits.cpu, limits.memory"?
Container spec missing resources.limits section Namespace has ResourceQuota tracking limits.cpu/limits.memory LimitRange requires explicit limits without providing defaults
Is the "must specify limits.cpu, limits.memory" error serious?
It is a medium-severity error — more of a blocker than a risk. The steps above resolve it.

Official resources & further reading