feat: add globalresourcequota api (#2068)

* feat: add globalresourcequota api

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

pkg/api/meta/labels.go

@@ -22,6 +22,8 @@ const (
 
 	ResourcePoolLabel = "projectcapsule.dev/pool"
 
+	GlobalResourceQuotaLabel = "projectcapsule.dev/global-resource-quota"
+
 	FreezeLabel = "projectcapsule.dev/freeze"
 
 	OwnerPromotionLabel          = "owner.projectcapsule.dev/promote"
@@ -41,6 +43,7 @@ const (
 	LimitRangeLabel    = "capsule.clastix.io/limit-range"
 	NetworkPolicyLabel = "capsule.clastix.io/network-policy"
 	ResourceQuotaLabel = "capsule.clastix.io/resource-quota"
+	RuleQuotaLabel     = "projectcapsule.dev/rule-quota"
 	RolebindingLabel   = "capsule.clastix.io/role-binding"
 )
 

pkg/api/meta/metadata.go

@@ -26,6 +26,7 @@ func NewManagedMetadata(
 			TenantLabel,
 			NewTenantLabel,
 			ResourcePoolLabel,
+			GlobalResourceQuotaLabel,
 			FreezeLabel,
 			OwnerPromotionLabel,
 			ServiceAccountPromotionLabel,
@@ -38,6 +39,7 @@ func NewManagedMetadata(
 			LimitRangeLabel,
 			NetworkPolicyLabel,
 			ResourceQuotaLabel,
+			RuleQuotaLabel,
 			RolebindingLabel,
 		),
 		annotations: stringSet(

pkg/api/rules/resource_quota_types.go

@@ -0,0 +1,22 @@
+// Copyright 2020-2026 Project Capsule Authors
+// SPDX-License-Identifier: Apache-2.0
+
+package rules
+
+import corev1 "k8s.io/api/core/v1"
+
+// ResourceQuotaRule defines a named ResourceQuota specification generated by a
+// Tenant rule. Name is the durable identity of the generated
+// GlobalResourceQuota and must be unique across all rules of a Tenant.
+// +kubebuilder:object:generate=true
+type ResourceQuotaRule struct {
+	corev1.ResourceQuotaSpec `json:",inline"`
+
+	// Name is the stable identity of this quota within the Tenant. Changing the
+	// name replaces the generated GlobalResourceQuota; changing the quota or its
+	// namespace selector updates the existing object.
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=63
+	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
+	Name string `json:"name"`
+}

pkg/api/rules/rule_body_types.go

@@ -3,9 +3,7 @@
 
 package rules
 
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-)
+import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 // For future implementation where users might manage RuleStatus CRs themselves
 // +kubebuilder:object:generate=true
@@ -15,6 +13,14 @@ type NamespaceRuleBodyNamespace struct {
 	// +optional
 	Audience []Audience `json:"audience,omitempty"`
 
+	// Quota contains native Kubernetes ResourceQuota specifications shared by
+	// all namespaces selected by this rule. Unlike Enforce, quota accounting is
+	// independent of the request audience.
+	// +optional
+	// +listType=map
+	// +listMapKey=name
+	Quota []ResourceQuotaRule `json:"quota,omitempty"`
+
 	// Enforcement for given rule
 	//+optional
 	Enforce *NamespaceRuleEnforceBody `json:"enforce,omitzero"`

pkg/api/rules/zz_generated.deepcopy.go

@@ -99,6 +99,13 @@ func (in *NamespaceRuleBodyNamespace) DeepCopyInto(out *NamespaceRuleBodyNamespa
 		*out = make([]Audience, len(*in))
 		copy(*out, *in)
 	}
+	if in.Quota != nil {
+		in, out := &in.Quota, &out.Quota
+		*out = make([]ResourceQuotaRule, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
 	if in.Enforce != nil {
 		in, out := &in.Enforce, &out.Enforce
 		*out = new(NamespaceRuleEnforceBody)
@@ -347,6 +354,22 @@ func (in *OCIRegistry) DeepCopy() *OCIRegistry {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceQuotaRule) DeepCopyInto(out *ResourceQuotaRule) {
+	*out = *in
+	in.ResourceQuotaSpec.DeepCopyInto(&out.ResourceQuotaSpec)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuotaRule.
+func (in *ResourceQuotaRule) DeepCopy() *ResourceQuotaRule {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuotaRule)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ServiceExternalNameRule) DeepCopyInto(out *ServiceExternalNameRule) {
 	*out = *in