Kubernetes "forbidden: exceeded quota" - Fix ResourceQuota in CI
By Daniel Zoghalchali·Latchkey
A ResourceQuota on the namespace caps total CPU, memory, or object counts. Your create/scale would exceed that cap, so the API server rejects it before any pod is scheduled - this is an admission error, not a scheduling one.
What this error means
kubectl apply/scale fails immediately with Error from server (Forbidden): ... is forbidden: exceeded quota: <quota>, requested: ..., used: ..., limited: .... Nothing is created because admission denies it.
kubectl output
Error from server (Forbidden): pods "api-7d9f8c6b54-2xk9p" is forbidden:
exceeded quota: compute-quota, requested: requests.memory=1Gi,
used: requests.memory=7Gi, limited: requests.memory=8Gi
Diagnose it: read events, not just status
A deployment that never becomes ready has the reason in its events and in the pod state, not in the deployment status. Read both before changing the manifest.
Terminal
kubectl rollout status deploy/<name> --timeout=120s
kubectl describe deploy/<name> | sed -n "/Events/,$p"
kubectl get pods -l app=<name> -o wide
kubectl describe pod <pod> | sed -n "/Events/,$p"
kubectl logs <pod> --previous --tail=50 # the crash before the restart
Common causes
Namespace at its resource cap
Existing workloads already consume most of the quota; the new pod’s requests push the total over limited, so admission rejects it.
Pods missing requests/limits under a quota
When a quota tracks requests.cpu/limits.memory, pods that omit those fields are rejected outright - the quota requires every pod to declare them.
How to fix it
See what the quota allows and uses
The quota describe shows used vs hard limits, so you know whether to free capacity or raise the cap.
Terminal
kubectl describe resourcequota -n <ns>
Free capacity or adjust the quota
Scale down or remove unused workloads in the namespace to reclaim quota.
Add requests/limits to pods if the quota requires them.
If the namespace genuinely needs more, raise the ResourceQuota (with cluster-admin approval).
How to prevent it
Set explicit requests/limits on every workload so quota-bound namespaces accept them.
Monitor namespace quota usage and clean up abandoned workloads.
Size quotas to real demand and review increases deliberately.
Frequently asked questions
What causes Kubernetes "forbidden: exceeded quota"?
There are 2 common causes: namespace at its resource cap and pods missing requests/limits under a quota. Existing workloads already consume most of the quota; the new pod’s requests push the total over limited, so admission rejects it.
How do I fix Kubernetes "forbidden: exceeded quota"?
There are 2 fixes depending on which cause you have: see what the quota allows and uses and free capacity or adjust the quota. Work through them in order, since the first is the most common.
What does Kubernetes "forbidden: exceeded quota" actually mean?
kubectl apply/scale fails immediately with Error from server (Forbidden): ...
How do I stop Kubernetes "forbidden: exceeded quota" happening again?
Set explicit requests/limits on every workload so quota-bound namespaces accept them. The prevention section lists 3 changes that keep it from recurring.
