Intelligent resource overcommit management for Kubernetes clusters
🚀 Quick Start • 📖 Documentation • 🤝 Contributing • 📝 License
The k8s-overcommit Operator is a Kubernetes operator designed to intelligently manage resource overcommit on pod resource requests. It automatically adjusts CPU and memory requests based on configurable overcommit classes, enabling better cluster resource utilization while maintaining workload performance.
- 🎛️ Flexible Overcommit Classes: Define different overcommit policies for different workload types
- 🏷️ Label-Based Configuration: Apply overcommit using pod or namespace labels
- 🛡️ Namespace Exclusions: Protect critical namespaces from overcommit policies
- 📊 Default Policies: Fallback overcommit values when no specific class is defined
- 🔒 Admission Webhooks: Seamless integration with Kubernetes admission controllers
- 📈 Resource Optimization: Improve cluster resource utilization efficiency
The operator is published in the community OLM catalogs, so it can be installed without cloning this repository:
| Catalog | Where it is available | Package | Channels |
|---|---|---|---|
| OperatorHub.io | Any Kubernetes cluster running OLM | k8s-overcommit |
stable (default), alpha |
| OpenShift community operators | OpenShift 4.15 and later, through the embedded OperatorHub | k8s-overcommit |
stable (default), alpha |
| Project catalog | Any Kubernetes cluster running OLM, catalog published from this repository | k8s-overcommit |
stable (default), alpha |
On a disconnected cluster, mirror the catalog image into your own registry before installing; the operator image and cert-manager have to be mirrored as well.
Clone the repository to your local machine:
git clone https://github.com/InditexTech/k8s-overcommit-operator.git
cd k8s-overcommit-operatorEdit the values.yaml file to customize your deployment. Below is an example configuration:
# Example configuration deployment: image: registry: ghcr.io image: inditextech/k8s-overcommit-operator tag: 1.3.6
Install the operator using Helm:
helm install k8s-overcommit-operator chart
The operator is published in the community OLM catalogs, so there is nothing to clone: on OpenShift 4.15 or later it is part of the embedded OperatorHub, and on upstream OLM clusters it comes from OperatorHub.io.
Create the Subscription:
apiVersion: operators.coreos.com/v1alpha1 kind: Subscription metadata: name: k8s-overcommit namespace: openshift-operators spec: channel: stable name: k8s-overcommit source: community-operators sourceNamespace: openshift-marketplace
community-operators in openshift-marketplace is the OpenShift catalog. On clusters that
consume OperatorHub.io instead, use source: operatorhubio-catalog and
sourceNamespace: olm. In the web console it is the same thing through
Operators → OperatorHub, searching for "K8s Overcommit".
Use this when you want the catalog published by this project instead of the community one.
1. Install the CatalogSource
kubectl apply -f https://raw.githubusercontent.com/InditexTech/k8s-overcommit-operator/refs/heads/main/deploy/catalog_source.yaml
2. Apply the OperatorGroup
kubectl apply -f https://raw.githubusercontent.com/InditexTech/k8s-overcommit-operator/refs/heads/main/deploy/operator_group.yaml
3. Create the Subscription
The repository ships a working Subscription in
deploy/subscription.yaml; apply it with:
kubectl apply -f https://raw.githubusercontent.com/InditexTech/k8s-overcommit-operator/refs/heads/main/deploy/subscription.yaml
After installation, check that the CSV reached Succeeded and that the operator pod is
running (the namespace is openshift-operators with Option A and k8s-overcommit with
Option B):
kubectl get csv -A | grep k8s-overcommit kubectl get pods -A | grep k8s-overcommit
Important
It's a singleton CRD: only can exist one, and it has to be called cluster
First, deploy the main Overcommit resource named "cluster":
apiVersion: overcommit.inditex.dev/v1alphav1 kind: Overcommit metadata: name: cluster spec: overcommitLabel: inditex.com/overcommit-class labels: environment: production annotations: description: "Main overcommit configuration"
Define overcommit classes for different workload types:
apiVersion: overcommit.inditex.dev/v1alphav1 kind: OvercommitClass metadata: name: high spec: cpuOvercommit: 0.2 # 20% of limits as requests memoryOvercommit: 0.8 # 80% of limits as requests excludedNamespaces: ".*(^(openshift|k8s-overcommit|kube).*).*" isDefault: true labels: workload-type: batch annotations: description: "High-density workloads with aggressive overcommit"
- Pod Level: Check if pod has the overcommit class label
- Namespace Level: If not found, check namespace labels
- Default Class: Apply default overcommit class if configured
Original Pod Specification:
apiVersion: v1 kind: Pod metadata: name: test labels: inditex.com/overcommit-class: high spec: resources: limits: cpu: "2" memory: "2Gi"
With OvercommitClass (cpuOvercommit: 0.2, memoryOvercommit: 0.8):
apiVersion: v1 kind: Pod metadata: name: test labels: inditex.com/overcommit-class: high spec: resources: limits: cpu: "2" # Unchanged memory: "2Gi" # Unchanged requests: cpu: "400m" # 2 * 0.2 = 0.4 cores memory: "1638Mi" # 2Gi * 0.8 = 1.6GiB
Protect critical namespaces using regex patterns:
excludedNamespaces: ".*(^(openshift|k8s-overcommit|kube).*).*"
This excludes:
openshift-*k8s-overcommit-*kube-*
| Topic | Description | Link |
|---|---|---|
| 🏗️ Architecture | Detailed architecture overview | Architecture Guide |
| 🧪 E2E Testing | End-to-end testing guide | E2E Testing |
| 🎯 Helm Configuration | Helm chart configuration options | Helm Values |
| 🤝 Contributing | How to contribute to the project | Contributing Guide |
| 📋 Code of Conduct | Community guidelines | Code of Conduct |
We welcome contributions! Please see our Contributing Guide for details on how to:
- 🐛 Report bugs
- 💡 Request features
- 🔧 Submit pull requests
- 📝 Improve documentation
# Generate the manifests make generate manifests # Install the CRDs make install # Run locally make run # Run tests make test # Build image make docker-build
Tilt is a tool that streamlines Kubernetes development by automating build, deploy, and live-update workflows.
./hack/tilt/run_tilt.sh
This project is licensed under the Apache License 2.0 - see the LICENSE file for details.
- Built with ❤️ by the Inditex Tech team
- Powered by Operator SDK
- Inspired by Kubernetes community best practices
⭐ Star this project if you find it useful!
Made with ❤️ for the Kubernetes community
flowchart LR
subgraph "Main Flow"
A[📝 API Request] --> B[🔧 API HTTP Handler]
B --> C[🔐 Authentication & Authorization]
C --> D[🔄 Mutating Admission]
D --> E[✅ Object Schema Validation]
E --> F[🛡️ Validating Admission]
F --> G[💾 Persisted to etcd]
end
subgraph "Mutating Webhooks"
direction LR
D --> MW1[🔄 Overcommit Webhook]
D --> MW2[🔄 Other Webhooks]
end
subgraph "Validating Webhooks"
direction LR
F --> VW1[✅ Validation Webhook 1]
F --> VW2[✅ Validation Webhook 2]
F --> VW3[✅ Validation Webhook 3]
end