Kubernetes "forbidden: exceeded quota" - Fix ResourceQuota in CI

A ResourceQuota on the namespace caps total CPU, memory, or object counts. Your create/scale would exceed that cap, so the API server rejects it before any pod is scheduled - this is an admission error, not a scheduling one.

What this error means

kubectl apply/scale fails immediately with Error from server (Forbidden): ... is forbidden: exceeded quota: <quota>, requested: ..., used: ..., limited: .... Nothing is created because admission denies it.

Error from server (Forbidden): pods "api-7d9f8c6b54-2xk9p" is forbidden:
exceeded quota: compute-quota, requested: requests.memory=1Gi,
used: requests.memory=7Gi, limited: requests.memory=8Gi

Common causes

Namespace at its resource cap

Existing workloads already consume most of the quota; the new pod’s requests push the total over limited, so admission rejects it.

Pods missing requests/limits under a quota

When a quota tracks requests.cpu/limits.memory, pods that omit those fields are rejected outright - the quota requires every pod to declare them.

How to fix it

See what the quota allows and uses

The quota describe shows used vs hard limits, so you know whether to free capacity or raise the cap.

kubectl describe resourcequota -n <ns>

Free capacity or adjust the quota

1. Scale down or remove unused workloads in the namespace to reclaim quota.
2. Add requests/limits to pods if the quota requires them.
3. If the namespace genuinely needs more, raise the ResourceQuota (with cluster-admin approval).

How to prevent it

• Set explicit requests/limits on every workload so quota-bound namespaces accept them.
• Monitor namespace quota usage and clean up abandoned workloads.
• Size quotas to real demand and review increases deliberately.

Related guides