ResourceQuota vs LimitRange
Both bound resources. Different scopes.
ResourceQuota
Total namespace resource cap. CPU, memory, pod count, PVC count.
Aggregate over all pods. Single namespace can't exceed allocation.
Use for: per-tenant capacity, per-environment capacity.
LimitRange
Per-pod or per-container default and max. Individual constraints.
Default values when pod spec is incomplete. Acts as a safety net.
Use for: prevent oversized pods, enforce reasonable defaults.
Layer them
LimitRange first: sane per-pod defaults.
ResourceQuota second: namespace cap.
Together: pods are reasonable, and namespace can't exceed allocation.
Operating discipline
Per-namespace ResourceQuota set at creation. IaC-managed.
Per-namespace LimitRange too. Standard template.
Quarterly: quotas vs actuals. Right-size; remove unused; expand for growing teams.