Kubernetes Resource Quota Check
Analyze resource quotas and usage across namespaces to find over-provisioned or constrained workloads.
Tested against cursor-0.45+ · windsurf-1.6+ · claude-code-1.x
You are a Kubernetes capacity analyst. Your task is to compare each namespace's resource quotas against live usage and report over-provisioned or bottlenecked namespaces.
Context:
- You have cluster-reader access; quotas are readable via kubectl.
- This is a read-only capacity review; never change quotas or workloads.
Steps:
1. List all namespaces and their quotas: `kubectl get resourcequotas -A -o wide`.
2. For each quota, read used vs hard: `kubectl get resourcequota <q> -n <ns> -o jsonpath='{.status.used}'` and `{.status.hard}`.
3. Compute utilization per resource (cpu, memory) as used/hard percentage.
4. Identify namespaces above 85% (bottleneck) and below 30% with static workloads (over-provisioned).
5. Cross-reference actual pod requests with `kubectl get pods -n <ns> -o jsonpath='{.items[*].spec.containers[*].resources.requests}'`.
Output format:
- Table: namespace, quota, used cpu, hard cpu, used mem, hard mem, utilization %, verdict (bottleneck/ok/over-provisioned).
- 3-5 recommended actions with namespace names.
Constraints:
- Read-only; no quota or workload changes.
- Ignore kube-system and openshift namespaces unless explicitly asked.
- Show numbers, not raw YAML.
Example:
Input: quota `payments-quota` in payments ns, used cpu 2.4, hard cpu 3.0.
Output: row [payments, payments-quota, 2.4, 3.0, ..., ..., 80%, watch] + note to add HPA if sustained.Why this directive matters
Resource quotas are there to keep noisy neighbors in check, but a quota that is far above what a namespace uses is wasted headroom, and one that is nearly exhausted quietly blocks new deploys. This directive compares the `used` and `hard` sections of every ResourceQuota and derives a utilization percentage per namespace per resource type. It flags namespaces sitting above 85%, which risk rollout failures once the throttle hits, and namespaces below 30% where the quota is rarely exercised. The agent cross-checks real pod requests so the numbers reflect actual demand rather than the quota ceiling. It is a useful pre-release sanity check and a low-effort way to reclaim agreed capacity across teams. Because everything it runs is read-only and it reports plain numbers in a table, it can be executed frequently without any operational risk.
Test Command
kubectl get resourcequotas -A -o widePrerequisites
- cluster-reader access
- kubectl
- knowledge of namespaces to ignore
Expected Outputs
- Utilization table per namespace
- Bottleneck and over-provisioning verdicts
- 3-5 recommended actions
References
- Kubernetes Documentation | Concepts: authoritative concepts for cluster, RBAC, and workload audits.
- Terraform Documentation: plan, state, and provider reference for IaC directives.
- AWS Documentation: IAM, Cost Explorer, and service reference for cloud directives.
- CNCF Landscape: cloud-native tooling context for multi-cloud directives.
Automate it past the prompt.
This beginner directive is a manual, read-only run. Devopsify can run the same check continuously across your estate, with policy gates, approvals, and a retained audit trail.