Both standard tools for capping a tenant do something other than capping.
LimitRange injects. ResourceQuota mandates.
Rejecting had to be written by hand — an admission rule that refuses without
filling anything in.
https://t.co/OwyIJfmp43
That one line would have made every Workload my operator renders unschedulable.
It sets no CPU limit on purpose. Throttling a container beats the latency cliff
a limit produces.
One line in a quota file, quietly overruling a decision made elsewhere.
So I moved the ceiling into a ResourceQuota instead.
Added limits.cpu. Every pod that doesn't set one:
pods "x" is forbidden: failed quota: must specify limits.cpu for: c
A quota on a resource doesn't cap it. It makes declaring it mandatory.
A LimitRange carrying only `max` uses that max as the default.
max:
memory: 512Mi
A pod that arrives declaring nothing now runs with 512Mi requested and limited.
The guardrail hands out the number it was there to refuse.