highIntermediateSymptom-first#resourcequota#limitrange#quota#scheduling

ResourceQuota / LimitRange exceeded — FailedCreate, pods rejected

Events show quota exceeded or limit range exceeded when creating pods

Likely source:availabilityscaling

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Events show quota exceeded or limit range exceeded when creating pods
  • New deployments fail with Forbidden: would exceed quota
  • Pod creation returns 403 Forbidden from the API server

ResourceQuota is a hard guardrail — it will reject pod creation with a 403 regardless of node capacity. Monitor quota usage as part of capacity planning.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Quota status

    kubectl describe resourcequota -n <namespace>

  • LimitRange configuration

    kubectl get limitrange -n <namespace>

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • kubectl describe resourcequota shows Used >= Hard
  • New pods rejected with Forbidden: would exceed quota

Confirm before fixing

kubectl describe resourcequota -n <namespace>
READ

Confirm quota exhaustion

Fix

kubectl patch resourcequota <quota> -n <namespace> --type merge -p '{"spec":{"hard":{"cpu":"40","memory":"80Gi"}}}'
CHANGE

Raise the quota limit (requires cluster-admin)

kubectl delete pod <large-pod> -n <namespace>
DESTRUCTIVE

Remove a large pod to free quota

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
kubectl describe resourcequota -n <namespace>
READ

Check current usage vs limits

2
kubectl get limitrange -n <namespace> -o yaml
READ

Review LimitRange constraints

3
kubectl describe namespace <namespace> | grep -A10 Events
READ

Read the Forbidden event

4
kubectl patch resourcequota <quota> -n <namespace> --type merge -p '{"spec":{"hard":{"cpu":"<new>","memory":"<new>"}}}'
CHANGE

Raise the quota to accommodate the workload

Prevention

  • Alert on quota usage > 80% per namespace.
  • Set resource requests/limits on all workloads so quota consumption is predictable.
  • Use LimitRange defaults so namespaces without explicit requests still get sensible limits.
  • Review quota as part of onboarding for new namespaces.

Related runbooks

Same stack, same failure family — worth a skim.

Pods stuck in Pending state — unschedulablehigh

kubectl get pods shows Pending for minutes

KubernetesIntermediate3 causes
Open runbook
Worker node NotReady — node down or kubelet failurecritical

kubectl get nodes shows NotReady for one or more workers

KubernetesAdvancedUSE3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.