quota-controller

Hierarchical quota delegation for the edge-connect platform — the implementation of ADR-0026.

quota-controller is part of the IPCEI-CIS cloud infrastructure initiative. Within the IPCEI-CIS edge framework it provides the multi-tenant quota governance layer: workspace admins delegate resource budgets down the kcp workspace tree, and admission-time reservation enforces them exactly at every level.

Workspace admins divide their granted budget among sub-workspaces via a QuotaPolicy CR (one per workspace, named default). The system enforces:

• Tightening invariant — a child's limits never exceed what its parent has left; checked at admission via CAS reservation against the parent's status.allocatedToChildren (§7).
• Root ceiling — the org-root QuotaPolicy must fit inside TenantPolicy.spec.quotas (ADR-0018 commercial ceiling, §3.2).
• Exact create gating — a thin admission webhook CAS-reserves against QuotaEnforcement.status.usage; trueup owners (the components that already watch each kind) converge the counter to ground truth (§4).

Components

Binary	Role
cmd/quota-controller	Owns QuotaPolicy: translates admitted limits into per-(workspace, enforcer) QuotaEnforcement directives, mirrors usage back onto QuotaPolicy.status.used, derives path/parentPath, trues up allocatedToChildren. Multicluster over the quotapolicies + quotaenforcements APIExports.
cmd/quota-admission-webhook	Serves both admission paths: reservation on creates of quota-managed kinds (§4a) and QuotaPolicy validation (tightening + root ceiling + allocation reservation, §3/§7).

Trueup reconcilers for counted kinds live with their existing watchers (platform controller, workspace-controller — see ADR-0026 §4b). This module ships the shared QuotaEnforcement contract and its enforcer-side implementation: pkg/trueup owns the trueup protocol (identity filtering, usage overwrite, observedGeneration, the Accepted condition, no-op write suppression); a host controller implements only the trueup.Counter hook over its existing informer cache and wires SetupWithManager with its counted kinds.

config/kcp embeds the generated APIResourceSchema manifests, so a host's integration suite can publish the quota APIs against a real kcp from the same bytes the Helm chart installs:

schema, err := kcpconfig.APIResourceSchemaYAML("quotaenforcements")

Development

make help          # all targets
make test          # unit tests
make test-e2e      # envtest integration suite
make test-kcp      # e2e against kcp (downloads and starts a throwaway kcp; set KCP_KUBECONFIG to reuse a running one)
make manifests     # regenerate CRDs + kcp APIResourceSchemas

Conventions mirror ../tenant-controller.

Architecture, decision flows and operating notes: docs/quota-controller.md.

License

Apache-2.0 — see LICENSE.

Funding and Support

This open source project is part of activities carried out within the Important Project of Common European Interest on Next Generation Cloud Infrastructure and Services (IPCEI-CIS) — FKZ 13IPC005, an EU initiative to build a sovereign, interoperable and energy-efficient cloud-to-edge infrastructure in Europe.

The work in this repository has been supported and co-funded by Deutsche Telekom in the context of IPCEI-CIS, where Deutsche Telekom contributes its expertise in secure, sustainable connectivity and cloud-edge platform orchestration for a European cloud-edge continuum.

Where applicable, further national or European public funding instruments associated with IPCEI-CIS may also have contributed to the development of this software.