WorkloadResourceConfig

WorkloadResourceConfig is a workload resource config document. WorkloadResourceConfig declares an aggregate memory ceiling for each Talos workload root.

The roots are kubepods, taloscontainers and virtualMachines; every root is optional and independent of the others. Omitting a root removes its aggregate cap; individual child limits still apply. A limit must be positive; it is rounded down to the host page size before it is applied, and bounds RAM only (including page cache charged to the root): swap and hugepages are not limited by it.

Talos exclusively owns memory.max on /taloscontainers and /virtualmachines.partition, even without this document. An omitted limit (zero internally) means an unlimited aggregate cap. Kubelet reserved-memory enforcement on these roots is rejected; CPU-only or compressible enforcement is allowed. Static validation cannot inspect external kubelet drop-in files; drop-in directories are rejected while any workload cap is active. Lowering a limit below current usage makes the kernel reclaim and OOM-kill within that root, which can terminate containers or virtual machines.

The kubepods limit is applied by the kubelet, which stays the only writer of its cgroup: Talos derives systemReserved.memory from the limit, so changing it restarts the kubelet, and a limit below the memory used by pods (control plane static pods included) causes OOM kills. The schedulable Node Allocatable is the limit minus the hard eviction threshold and any hugepage capacity, so it is lower than the limit. Setting systemReserved.memory, the equivalent kubelet command line flags or the Static memory manager policy together with the limit is rejected. The limit is inactive while Kubernetes is not configured on the machine; the other roots are enforced regardless.

In container mode the document is validated but declares no policy.