All Policies
Add Quota
To better control the number of resources that can be created in a given Namespace and provide default resource consumption limits for Pods, ResourceQuota and LimitRange resources are recommended. This policy will generate ResourceQuota and LimitRange resources when a new Namespace is created.
Policy Definition
/best-practices/add_ns_quota.yaml
1apiVersion: kyverno.io/v1
2kind: ClusterPolicy
3metadata:
4 name: add-ns-quota
5 annotations:
6 policies.kyverno.io/title: Add Quota
7 policies.kyverno.io/category: Multi-Tenancy
8 policies.kyverno.io/subject: ResourceQuota, LimitRange
9 policies.kyverno.io/description: >-
10 To better control the number of resources that can be created in a given
11 Namespace and provide default resource consumption limits for Pods,
12 ResourceQuota and LimitRange resources are recommended.
13 This policy will generate ResourceQuota and LimitRange resources when
14 a new Namespace is created.
15spec:
16 rules:
17 - name: generate-resourcequota
18 match:
19 resources:
20 kinds:
21 - Namespace
22 generate:
23 kind: ResourceQuota
24 name: default-resourcequota
25 synchronize: true
26 namespace: "{{request.object.metadata.name}}"
27 data:
28 spec:
29 hard:
30 requests.cpu: '4'
31 requests.memory: '16Gi'
32 limits.cpu: '4'
33 limits.memory: '16Gi'
34 - name: generate-limitrange
35 match:
36 resources:
37 kinds:
38 - Namespace
39 generate:
40 kind: LimitRange
41 name: default-limitrange
42 synchronize: true
43 namespace: "{{request.object.metadata.name}}"
44 data:
45 spec:
46 limits:
47 - default:
48 cpu: 500m
49 memory: 1Gi
50 defaultRequest:
51 cpu: 200m
52 memory: 256Mi
53 type: Container