Enforce Resource Quotas per Namespace
Set CPU and memory quotas on each namespace so a team cannot accidentally consume all cluster resources.
Task
Configure kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a so the cluster enforces the policy at admission time instead of relying on manual review.
When to use this
A developer deploys a pod without kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a and it disrupts a node, causing evictions on a production cluster.
Prerequisites
- A Kubernetes cluster with kubectl access
- Cluster admin or namespace edit RBAC
Steps
1. Configure kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a in the project configuration file with the recommended defaults.
kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a
Expected output: The configuration is accepted and kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a runs without errors on the first invocation.
2. Run the check locally to verify kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a produces the expected result before pushing.
pnpm test
Expected output: Local run matches CI behavior; no surprises after push.
3. Add the gate to the CI pipeline so kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a blocks merge on failure.
- name: Run add namespace quota enforce
run: pnpm test
Expected output: Pull requests with failing kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-a are blocked from merging.
Troubleshooting
Problem
The check passes locally but fails in CI
Solution
Pin dependency versions and the runtime to match CI exactly; reproduce with the same Docker image or act.
Problem
Configuration is rejected with a schema error
Solution
Check the tool version matches the config schema; older versions may not support newer fields.
Limitations
- The gate only runs on events that trigger the workflow; locally pushed commits bypass it.
- Configuration drift is possible if someone edits settings outside version control.
Enforce at admission
Start by measuring the problem. Set CPU and memory quotas on each namespace so a team cannot accidentally consume all cluster resources. The most common mistake is adding the gate without first confirming it catches the issue you care about. Run kubectl create quota team-quota –hard=cpu=10,memory=20Gi,pods=50 –namespace=team-a against the current codebase and inspect the output before wiring it into CI.
kubectl create quota team-quota --hard=cpu=10,memory=20Gi,pods=50 --namespace=team-aVerify the policy
Once the gate is in place, make failures actionable. A failing kubectl create quota team-quota –hard=cpu=10,memory=20Gi,pods=50 –namespace=team-a should point to the exact file and line, not a generic error. Pin the tool version in the lockfile so a upstream release does not silently change behavior. Review the gate output in every pull request just like a test result.