A resource quota, defined by a ResourceQuota object, provides constraints that limit aggregate resource consumption per namespace.
It can limit the quantity of objects that can be created in a namespace by type, as well as the total amount of compute resources that may be consumed by resources in that project.
Resource quotas work like this:
-
Different teams work in different namespaces. Currently this is voluntary, but support for making this mandatory via ACLs is planned.
-
The administrator creates one or more ResourceQuotas for each namespace.
-
Users create resources (pods, services, etc.) in the namespace, and the quota system tracks usage to ensure it does not exceed hard resource limits defined in a ResourceQuota.
-
If creating or updating a resource violates a quota constraint, the request will fail with HTTP status code 403 FORBIDDEN with a message explaining the constraint that would have been violated.
-
If quota is enabled in a namespace for compute resources like cpu and memory, users must specify requests or limits for those values; otherwise, the quota system may reject pod creation.
Hint: Use the LimitRanger admission controller to force defaults for pods that make no compute resource requirements.