kubernetes.resourcequota.ensure

Create or replace a namespaced Kubernetes ResourceQuota

Creates a ResourceQuota in the given namespace; replaces it in full if it already exists. Accepts a pre-built quota_spec dict matching the Kubernetes V1ResourceQuotaSpec schema so callers build the spec however they want.

A ResourceQuota is how a namespace becomes a bounded tenant: it caps the aggregate CPU, memory, storage, and object counts every pod in that namespace can claim. Without one, a single tenant can starve every other tenant on the cluster.

Why replace and not patch

spec.hard is a map[string]Quantity, so a strategic-merge patch merges it key-by-key and a quota key removed from the declared spec would linger on the cluster — leaving a limit in force that the caller believes it lifted, or vice versa. Full replacement guarantees the live quota matches quota_spec exactly. Same reasoning as kubernetes.networkpolicy.ensure; configmap / service / deployment / secret already use replace for exact-state reasons.

Setting a quota on a namespace that already exceeds it does not evict anything — Kubernetes rejects the next request that would exceed the cap. Read used from kubernetes.resourcequota.get to see where a tenant actually stands before tightening a limit.

Inputs:

• connection_uuid: Cloud connection UUID (required)
• namespace: Target namespace (required)
• name: ResourceQuota name (required)
• quota_spec: Full V1ResourceQuotaSpec dict (required). Supports hard, scopes, and scopeSelector.
• labels: Optional dict of metadata labels set on the object.

Outputs:

• existed: True if an existing ResourceQuota was replaced, False if created.
• hard: The enforced limits as the API server echoed them back.

Plugin required: context.get_plugin("connection").kubernetes_runner_clients(connection_uuid, organization_uuid) must expose core_v1 with read_namespaced_resource_quota, replace_namespaced_resource_quota, create_namespaced_resource_quota.

Overview

Property	Value
Workflow type	Atomic
Library	App-kubernetes
Version	1.0

Input Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	Yes	—	—
namespace	string	Yes	—	—
name	string	Yes	—	—
quota_spec	json	Yes	—	—
labels	json	No	—	—
organization_uuid	uuid	No	—	—

Output Schema

Field	Type	Required	Default	Description
connection_uuid	uuid	No	—	—
organization_uuid	uuid	No	—	—
namespace	string	No	—	—
name	string	No	—	—
quota_spec	json	No	—	—
labels	json	No	—	—
existed	boolean	No	—	—
hard	json	No	—	—
failure_reason	string	No	—	—
failure_type	string	No	—	—
failed_action	string	No	—	—
failed_at_state	string	No	—	—
failed_step	string	No	—	—
failed_layer	string	No	—	—
error	string	No	—	—
error_type	string	No	—	—

States

State	Initial	Terminal	Success	Auto-advance	Description
pending	Yes	No	—	execute	—
completed	No	Yes	Yes	—	—
failed	No	Yes	No	—	—

State Diagram

Transitions

From	Action	To	Description
pending	execute	completed	—
* (any state)	fail	failed	—

API Usage

POST /api/workflows/start
Content-Type: application/json

{
  "workflow_type": "kubernetes.resourcequota.ensure",
  "initial_data": {
    "connection_uuid": "value",
    "namespace": "value",
    "name": "value",
    "quota_spec": "value"
  }
}