---
id: w7/m2/t003
title: "ResourceQuota + LimitRange on the apps namespace; resource limits on BuildKit Jobs"
worker: worker7
status: done
estimate: 45m
depends_on: []
---

## Objective

Aggregate resource ceilings so no tenant (or runaway build) can starve the node: a ResourceQuota + LimitRange on the apps namespace as defense-in-depth beyond w1/m8's per-pod plan limits, and cpu/mem limits on BuildKit build Jobs, which today run unbounded.

## Context

- Verified 2026-07-09: no ResourceQuota/LimitRange anywhere in the repo; `lego/operator/internal/build/build.go` sets `ActiveDeadlineSeconds`/`BackoffLimit`/`TTLSecondsAfterFinished` but no `Resources`.
- w1/m8 plan limits bound each tenant pod; the quota bounds the *sum* (and catches anything that slips per-pod limits). LimitRange supplies defaults for pods created without explicit requests (e.g. datastore sidecars).
- Builds run tenant-supplied Dockerfiles (arbitrary build-time compute) in `BEX_BUILD_NAMESPACE` — bound them like any tenant workload.
- Quota sizing: generous first cut (documented), tightened later with w7's usage data if the metering track ever lands.

## Steps

1. Add ResourceQuota + LimitRange manifests for the apps namespace (and `BEX_BUILD_NAMESPACE` if distinct) where the m1 ADR put namespace config.
2. Set `Resources` requests/limits on the build container in `build.go` (env-tunable if a knob is warranted; otherwise a sane constant, documented).
3. Redeploy the mock cluster; run a build-from-git deploy to confirm builds complete within limits.

## Files

- `deploy/gitops/` (quota/limitrange manifests) **or** the projector's namespace creation — per the m1 ADR
- `lego/operator/internal/build/build.go` (+ `build_test.go`)

## Acceptance criteria

- [ ] `kubectl describe quota` shows the ceiling in the apps namespace; over-quota scheduling is refused
- [ ] Build Job spec carries cpu/mem requests+limits; `hello-go` build still completes
- [ ] Limits/quota values documented (ADR or docs/ADR004-deployment.md)

## Out of scope

- Per-workspace quotas (needs namespace-per-workspace or quota-by-label machinery — note for the ADR's consequences section)
