# Kubernetes "forbidden: exceeded quota" - Fix ResourceQuota in CI

> Fix Kubernetes "is forbidden: exceeded quota" in CI - a namespace ResourceQuota that blocks creating pods because the request would push CPU, memory, or object counts over the limit.

Source: https://latchkey.dev/learn/kubernetes/k8s-pod-exceeded-quota  
Updated: 2026-06-25

A `ResourceQuota` on the namespace caps total CPU, memory, or object counts. Your create/scale would exceed that cap, so the API server rejects it before any pod is scheduled - this is an admission error, not a scheduling one.

## Diagnose it: read events, not just status

A deployment that never becomes ready has the reason in its events and in the pod state, not in the deployment status. Read both before changing the manifest.

```Terminal
kubectl rollout status deploy/<name> --timeout=120s
kubectl describe deploy/<name> | sed -n "/Events/,$p"
kubectl get pods -l app=<name> -o wide
kubectl describe pod <pod> | sed -n "/Events/,$p"
kubectl logs <pod> --previous --tail=50   # the crash before the restart
```

> `--previous` gives you the logs of the container that died, which is the one that explains a CrashLoopBackOff. The current container is usually still starting and tells you nothing.

## FAQ

### What causes Kubernetes "forbidden: exceeded quota"?

There are 2 common causes: namespace at its resource cap and pods missing requests/limits under a quota. Existing workloads already consume most of the quota; the new pod’s requests push the total over limited, so admission rejects it.

### How do I fix Kubernetes "forbidden: exceeded quota"?

There are 2 fixes depending on which cause you have: see what the quota allows and uses and free capacity or adjust the quota. Work through them in order, since the first is the most common.

### What does Kubernetes "forbidden: exceeded quota" actually mean?

kubectl apply/scale fails immediately with Error from server (Forbidden): ...

### How do I stop Kubernetes "forbidden: exceeded quota" happening again?

Set explicit requests/limits on every workload so quota-bound namespaces accept them. The prevention section lists 3 changes that keep it from recurring.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt