Enforce Quotas and Pod Security Standards

Why this matters

Multi-tenant clusters die by tragedy of the commons: one namespace's runaway consumes the cluster, one privileged pod weakens every neighbor. Quotas plus standards move these from tribal knowledge to enforced admission, and the exam tests reading the rejections because every violation prints its reason.

Concepts

ResourceQuota caps a namespace: compute totals (requests plus limits for CPU and memory), object counts (pods, services, PVCs), and class-scoped flavors. Quota counts only objects that declare the tracked fields, which is why quota plus LimitRange pair well: the range supplies defaults so every pod counts. Exceeding quota rejects creation with the exceeded figure quoted.

Pod Security Standards define three profiles: privileged (unrestricted, for system agents only), baseline (blocks known privilege escalations while allowing normal apps), restricted (demands non-root, dropped caps, seccomp: the hardened default for your apps). Enforcement is per-namespace via labels (pod-security.kubernetes.io/enforce: restricted), with warn plus audit modes for migration before enforcement bites.

Worked example

Team namespace with a budget plus a bouncer, violations demonstrated:

# budget: 8 CPU requests, 16Gi memory, 10 pods max
apiVersion: v1
kind: ResourceQuota
metadata: { name: team-budget, namespace: team-a }
spec:
  hard: { requests.cpu: "8", requests.memory: 16Gi, pods: "10" }
# bouncer: restricted enforced, baseline warned during migration
kubectl label namespace team-a \
  pod-security.kubernetes.io/enforce=restricted \
  pod-security.kubernetes.io/warn=baseline
# violation one: 11th pod rejected naming the quota
# violation two: privileged pod rejected naming the policy
kubectl apply -f privileged-pod.yaml  # Forbidden: violates PodSecurity "restricted:latest"

Both rejections quote the rule: the quota names the exceeded hard figure, the policy names the violated check. Read the message, fix the manifest, never the enforcement.

Exam notes

Quota ignores objects missing the tracked fields: unrequested pods dodge compute quota, which is why LimitRange closes the loop. Standards evaluate the whole pod: one privileged container fails the namespace. And enforce versus warn versus audit stack deliberately: migrate namespaces through warn before enforce or the first deploy becomes the incident.