Skip to content

Room 39

RESOURCE QUOTAS

The Rationing Chamber

  • ResourceQuotas limit total resources a namespace can consume.
  • A namespace has hit its quota. Find out what’s blocked and get the password.

📜 Mission Briefing

  1. Create namespace rationed and apply quota.yaml.
  2. The quota limits: max 5 pods, 2 CPU, 2Gi memory.
  3. Deploy pods until the quota is exhausted.
  4. Check quota usage: kubectl get resourcequota -n rationed.
  5. The quota has an annotation with the password: quota42.
Key Commands
Command Purpose
kubectl get quota -n NS View quotas
kubectl describe quota NAME -n NS Quota usage details
kubectl create quota NAME --hard=pods=10,cpu=4 Create quota
How ResourceQuotas Work
apiVersion: v1
kind: ResourceQuota
metadata:
  name: namespace-quota
  namespace: rationed
  annotations:
    escape-password: "quota42"
spec:
  hard:
    pods: "5"
    requests.cpu: "2"
    requests.memory: "2Gi"
    limits.cpu: "4"
    limits.memory: "4Gi"
    services: "5"
    services.loadbalancers: "1"
    persistentvolumeclaims: "5"
    requests.storage: "10Gi"
    configmaps: "10"
    secrets: "10"

# Quota scopes:
# - Compute:  cpu, memory (requests and limits)
# - Object:   pods, services, configmaps, secrets, PVCs
# - Storage:  requests.storage, PVCs per storage class

# When quota is set for cpu/memory, ALL pods MUST specify requests/limits

# Check quota usage
kubectl get resourcequota -n rationed
kubectl describe resourcequota namespace-quota -n rationed
# Used   Hard
# ----   ----
# pods   3      5
# cpu    1500m  2

# Quota with scopes
apiVersion: v1
kind: ResourceQuota
metadata:
  name: priority-quota
spec:
  hard:
    pods: "10"
  scopeSelector:
    matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["high"]
Hints

Hint 1

kubectl create ns rationed
kubectl apply -f quota.yaml
kubectl get quota -n rationed

Hint 2

kubectl get resourcequota namespace-quota -n rationed -o jsonpath='{.metadata.annotations.escape-password}'

Hint 3

The password is quota42.

🔓 Unlock Room 40

openssl enc -aes-256-cbc -d -a -pbkdf2 \
        -in ../room_40/README -out ../room_40/README.txt -pass pass:PASSWORD
cat ../room_40/README.txt