ResourceQuotas are the namespace-level spending limit. They cap the total amount of resources (CPU, memory, storage, object count) that all Pods in a namespace can collectively consume. This prevents one team from monopolizing the cluster.

1. Compute Resource Quotas

apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-quota
  namespace: team-alpha
spec:
  hard:
    requests.cpu: "8"              # Total CPU requests across all Pods
    requests.memory: 16Gi          # Total memory requests
    limits.cpu: "16"               # Total CPU limits
    limits.memory: 32Gi            # Total memory limits
    pods: "20"                     # Maximum number of Pods

How It Works

# Current state:
kubectl describe quota compute-quota -n team-alpha
# Name:            compute-quota
# Resource         Used    Hard
# --------         ----    ----
# limits.cpu       6       16
# limits.memory    12Gi    32Gi
# pods             8       20
# requests.cpu     3       8
# requests.memory  8Gi     16Gi

# If a developer tries to create a Pod requesting 6 CPU (would total 9):
# → REJECTED: exceeded quota (requests.cpu: 9 > hard limit 8)

The LimitRange Requirement

When a ResourceQuota for compute resources exists, every Pod must specify requests and limits. Otherwise the quota can't account for the Pod's usage. If a Pod doesn't specify them, it's rejected.

# Common error:
# "Error: pods "web" is forbidden: failed quota: compute-quota:
#  must specify limits.cpu, limits.memory, requests.cpu, requests.memory"

# Solution: Pair ResourceQuota with a LimitRange that provides defaults:
apiVersion: v1
kind: LimitRange
metadata:
  name: default-resources
  namespace: team-alpha
spec:
  limits:
    - type: Container
      defaultRequest:
        cpu: 100m
        memory: 128Mi
      default:
        cpu: 500m
        memory: 256Mi

2. Object Count Quotas

Limit how many objects of each type can exist in a namespace:

apiVersion: v1
kind: ResourceQuota
metadata:
  name: object-counts
  namespace: team-alpha
spec:
  hard:
    pods: "20"
    services: "10"
    services.loadbalancers: "2"     # Expensive! Limit these
    services.nodeports: "5"
    secrets: "50"
    configmaps: "50"
    persistentvolumeclaims: "10"
    count/deployments.apps: "10"    # Generic format: count/.
    count/jobs.batch: "5"
    count/cronjobs.batch: "3"

Generic Count Syntax

# Format: count/.
count/deployments.apps         # Deployments in apps group
count/statefulsets.apps        # StatefulSets
count/ingresses.networking.k8s.io  # Ingresses
count/roles.rbac.authorization.k8s.io  # Roles

3. Storage Quotas

apiVersion: v1
kind: ResourceQuota
metadata:
  name: storage-quota
  namespace: team-alpha
spec:
  hard:
    requests.storage: 500Gi              # Total PVC storage requests
    persistentvolumeclaims: "10"         # Max number of PVCs
    
    # Per-StorageClass quotas:
    gp3-encrypted.storageclass.storage.k8s.io/requests.storage: 200Gi
    gp3-encrypted.storageclass.storage.k8s.io/persistentvolumeclaims: "5"
    
    premium-iops.storageclass.storage.k8s.io/requests.storage: 100Gi
    premium-iops.storageclass.storage.k8s.io/persistentvolumeclaims: "2"

4. Quota Scopes — Targeting Specific Pods

Scopes let you apply quotas only to Pods matching certain criteria:

Priority Class Scoped Quotas

# Different budgets for different priority levels:
apiVersion: v1
kind: ResourceQuota
metadata:
  name: high-priority-quota
  namespace: team-alpha
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi
    pods: "5"
  scopeSelector:
    matchExpressions:
      - scopeName: PriorityClass
        operator: In
        values: ["high"]
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: low-priority-quota
  namespace: team-alpha
spec:
  hard:
    requests.cpu: "2"
    requests.memory: 4Gi
    pods: "20"
  scopeSelector:
    matchExpressions:
      - scopeName: PriorityClass
        operator: In
        values: ["low", "batch"]

5. Multi-Tenancy Pattern

# For a shared cluster with 3 teams:
# Total cluster: 48 CPU, 128Gi memory

# team-alpha namespace:    16 CPU, 40Gi   (33% of cluster)
# team-beta namespace:     16 CPU, 40Gi   (33% of cluster)
# platform namespace:      8 CPU, 32Gi    (shared services)
# Buffer (unallocated):    8 CPU, 16Gi    (headroom for bursting)

# Each namespace gets a ResourceQuota + LimitRange:
# Quota = budget ceiling
# LimitRange = per-Pod guardrails (min/max/defaults)

Summary