November 2026 Summaries

Kubernetes CPU limits are enforced through Completely Fair Scheduler quotas configured by the kubelet, but if the kubelet’s cpuCFSQuota setting is disabled, containers can exceed the CPU limits declared in their manifests while still appearing properly configured in dashboards and code. This mismatch creates reliability risks because runaway workloads, traffic spikes, or bugs may consume all available node CPU, undermine capacity planning, and alter the scope of Gremlin CPU experiments, which then use total node capacity rather than the container’s stated limit. Although teams may disable CFS quotas to avoid throttling-related latency for multithreaded, latency-sensitive applications, safer alternatives include increasing limits, relying on requests for selected workloads, or isolating them on dedicated node pools. Administrators can identify affected nodes through kubelet configuration or cgroup values, locate pods with CPU limits on those nodes, and use Gremlin’s Detected Risks feature to automate detection. Restoring enforcement requires right-sizing limits first, enabling cpuCFSQuota in managed or self-managed node configurations, restarting workloads and relevant agents, and verifying that containers again report a finite CPU quota.