[backport v2.14] [BUG]project-level resource quotas are not correctly enforced in certain cases

Author: rancherbotCreated Aug 19, 2026Updated Sep 17, 2026

Labelsarea/projectsarea/rbacQA/Mrelease-notestatus/release-blockerteam/collie

This is a backport issue for #54690, automatically created via GitHub Actions workflow initiated by @snasovich

Original issue body:

v2.14.0

The fix in #53150 ensures that project quotas are enforced during namespace creation by zeroing out oversubscribed resources. However, it appears this only applies at creation time and does not cover scenarios where ResourceQuota Object is updated after namespace creation.

tested on 2.15-head and observed that modifying the namespace ResourceQuota allows increasing limits beyond the project quota which needs to be addressed. Currently, Project-level enforcement does not appear to be re-evaluated after ResourceQuota object is updated.

$ k get resourcequota -A
No resources found
 
#CREATED PROJECT p-c5w2r WITH RESOURCE QUOTA
 displayName: tp1
 namespaceDefaultResourceQuota:
  limit:
   limitsCpu: 1000m
   limitsMemory: 1024Mi
 resourceQuota:
  limit:
   limitsCpu: 2000m
   limitsMemory: 2048Mi
  usedLimit: {}
 
#CREATE NAMESPACE IN THE PROJECT USING ALL THE RESOURCES
$ k get resourcequota -A
NAMESPACE  NAME      REQUEST  LIMIT                  AGE
tn1     default-5b564       limits.cpu: 0/2, limits.memory: 0/2Gi  3s
 
# PROJECT p-c5w2r
 displayName: tp1
 namespaceDefaultResourceQuota:
  limit:
   limitsCpu: 1000m
   limitsMemory: 1024Mi
 resourceQuota:
  limit:
   limitsCpu: 2000m
   limitsMemory: 2048Mi
  usedLimit:
   limitsCpu: "2"
   limitsMemory: 2Gi
 
 
# EDIT RESOURCE QUOTA OBJECT TO INCREASE THE QUOTA BEYOND WHAT IS ALLOCATED FOR THE PROJECT
$ k get resourcequota -A
NAMESPACE  NAME      REQUEST  LIMIT                  AGE
tn1     default-5b564       limits.cpu: 0/4, limits.memory: 0/4Gi  3m55s
 
# CREATE A DEPLOYMENT IN THE NAMESPACE USING THE NEW LIMIT
$ k get resourcequota -A
NAMESPACE  NAME      REQUEST  LIMIT                   AGE
tn1     default-5b564       limits.cpu: 4m/4, limits.memory: 4Gi/4Gi  8m7s

# PROJECT p-c5w2r 
  clusterName: local
  containerDefaultResourceLimit: {}
  displayName: tp1
  namespaceDefaultResourceQuota:
    limit:
      limitsCpu: 1000m
      limitsMemory: 1024Mi
  resourceQuota:
    limit:
      limitsCpu: 2000m
      limitsMemory: 2048Mi
    usedLimit:
      limitsCpu: "2"
      limitsMemory: 2Gi

Source: rancher/rancher

View original on GitHub View discussion on GitHub