Quotas and Limits¶

ResourceQuota and LimitRange are applied to every tenant namespace to prevent any single tenant from exhausting cluster resources and to set safe container defaults.

Defaults¶

Resource	ResourceQuota	LimitRange (container default)
CPU	request: 4 cores total	request: 100m, limit: 500m
Memory	request: 8Gi total	request: 128Mi, limit: 512Mi
Pods	30	-

Rationale¶

Sized against current ECS footprint with 2x HPA headroom per tenant. A typical tenant runs: api (2 replicas), worker (1), websockets (1), scheduler (1) = ~5 pods. 30-pod cap allows ~6x current footprint before quota blocks new pods.

Per-tenant override¶

Edit platform/charts/resource-quotas/values.yaml, uncomment the tenants section:

tenants:
  mansety-prd:
    quota:
      cpu: "8"
      memory: 16Gi
      pods: "60"

Commit and push - Argo auto-syncs within ~3 min.

Interaction with HPA¶

HPA scales pods up to its maxReplicas. If ResourceQuota is exhausted before maxReplicas is reached, the HPA will not be able to schedule new pods. The HPA will log: unable to scale due to quota limit.

Monitor: kubectl -n oep-stg describe quota to see current vs hard limits.

Debug: "forbidden: exceeded quota"¶

kubectl -n oep-stg describe quota
# Check: used vs hard for each resource

# Find which pods are consuming the most
kubectl -n oep-stg top pods

# Event stream for admission denials
kubectl -n oep-stg get events --field-selector reason=FailedCreate | grep -i quota

Adding a 4th tenant¶

See add-tenant.md for the full onboarding checklist including quota sizing.