Enforce Namespace Compute Quota with requests and limits caps

This manifest applies a ResourceQuota to a namespace, capping aggregate CPU and memory requests and limits while also enforcing a pod count ceiling. Internally, the kube-apiserver's quota admission controller intercepts every create and update for pods (and other quota-tracked resources) and validates the projected usage against the quota's hard limits. If the sum of existing usage plus the incoming object would exceed any hard value, the API server rejects the request with a 403 Forbidden and a 'exceeded quota' message. ResourceQuota status is recomputed by the quota controller in kube-controller-manager on a resync loop, so usage numbers can lag behind reality by a few seconds.

In production, this pattern is essential for multi-tenant clusters where each team gets a namespace and you must prevent a single noisy deployment from starving shared nodes. It is also the first line of defense for cost governance: by forcing requests.cpu and requests.memory to be set, you guarantee the scheduler has real signals, and by capping limits you bound worst-case node pressure. Apply it before workloads land, because once a namespace is over quota, new pods are blocked and existing ones keep running, creating a confusing partial-failure state.

Security-wise, a loose quota is effectively no quota; attackers who can create pods can exhaust a namespace or trigger node eviction storms. Performance-wise, the admission check is cheap but the quota controller's periodic recalculation can be costly at very high object counts, so keep quotas scoped per team rather than cluster-wide. Common pitfalls: forgetting that a namespace with a requests.cpu quota forces ALL pods to declare CPU requests, breaking Helm charts that omit them; and mixing quota with LimitRange incorrectly so defaults conflict with caps.

> System.Execute()

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: ResourceQuota
metadata:
  name: team-compute-quota
  namespace: team-alpha
spec:
  hard:
    requests.cpu: "20"
    requests.memory: 40Gi
    limits.cpu: "40"
    limits.memory: 80Gi
    pods: "100"
    count/deployments.apps: "30"
EOF
kubectl describe resourcequota team-compute-quota -n team-alpha

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-E5CF8E879D77