feat: requests and limit policies (#2095)

* chore: save progress

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

playground/platform/globalresourcequotas/green-shared-compute.yaml

@@ -11,7 +11,7 @@ spec:
         capsule.clastix.io/tenant: green
   quota:
     hard:
-      limits.cpu: "8"
+      limits.cpu: "0"
       limits.memory: 16Gi
       requests.cpu: "8"
       requests.memory: 16Gi

playground/platform/resourcepools/pool-renewable.yaml

@@ -6,8 +6,8 @@ metadata:
 spec:
   quota:
     hard:
-      limits.cpu: "2"
       limits.memory: 2Gi
+      limits.cpu: "0"
       requests.cpu: "2"
       requests.memory: 2Gi
       requests.storage: "5Gi"

playground/platform/resourcepools/pool-solar.yaml

@@ -8,8 +8,8 @@ metadata:
 spec:
   quota:
     hard:
-      limits.cpu: "2"
       limits.memory: 2Gi
+      limits.cpu: "0"
       requests.cpu: "2"
       requests.memory: 2Gi
       requests.storage: "5Gi"

playground/platform/tenants/green.yaml

@@ -20,6 +20,16 @@ spec:
   - enforce:
       action: allow
       metadata:
+        - apiGroups:
+            - "v1"
+          kinds:
+            - "Namespace"
+          labels:
+            projectcapsule.dev/backup:
+              managed: "true"
+          annotations:
+            storagelocationtype:
+              managed: "s3"
         - kinds:
             - Pod
           annotations:

playground/platform/tenants/wind.yaml

@@ -17,16 +17,24 @@ spec:
     - matchLabels:
         team: devops
   rules:
-    - namespaceSelector:
-        matchLabels:
-          company.example/tier: application
-      quota:
+    # Enforce Resource-Allocation to best-practices
+    - quota:
         - name: billable-compute
           hard:
             requests.cpu: "8"
             requests.memory: 16Gi
-            limits.cpu: "8"
+            limits.cpu: "0"
             limits.memory: 16Gi
+            requests.storage: "5Gi"
+      enforce:
+        action: deny
+        workloads:
+          resources:
+            limits:
+              cpu:
+                policy: Remove
+              memory:
+                policy: MatchRequest
     - permissions:
         bindings:
           - clusterRoleName: 'view'