Check namespace quota before adding Kubernetes node capacity

ResourceQuota rejects requests that violate a namespace allowance, using an explanatory HTTP 403 response.

Source facts

Kubernetes ResourceQuota constrains aggregate resource consumption or object counts within a namespace. A creation or update violating a quota is rejected with HTTP 403 and an explanatory message. Compute quotas can require Pods to specify the relevant requests or limits. CPU and memory quota accounting sums the applicable values across nonterminal Pods rather than merely checking currently measured consumption.

Source: Kubernetes documentation — Resource Quotas.

Applicability

Review namespace resource admission and quota accounting before proposing a capacity change.

DSE recommendation

DSE recommends reading the API rejection and the namespace’s quota usage before proposing additional nodes. Identify whether the exhausted allowance concerns requested compute, limits, storage, or an object count. Review abandoned workloads and the business owner of the allowance before increasing it. A quota increase should be justified by the expected workload population, while default resource declarations should remain consistent with application sizing. Preserve the original rejection in the ticket so a later successful admission can be linked to the actual corrective change.

Verification

In an approved test namespace, compare the declared quota with its used values and attempt a small request beyond one boundary. Confirm the exact reported constraint, then verify that an in-policy request is admitted without changing node capacity. Record the admitted request’s declared values and the relevant quota delta. Have the namespace owner confirm that the observed allowance belongs to the intended workload population and is not a different resource’s limit.

Official reference

Kubernetes documentation — Resource Quotas. Reviewed October 20, 2026.