Tenant Namespaces Should Have A ResourceQuota

# 1) List tenant namespaces that lack a ResourceQuota
# Run on: any machine with kubectl access
{ kubectl get resourcequotas --all-namespaces -o json
  kubectl get namespaces -o json
} | jq -rs '
  .[0] as $quotas | .[1] |
  [ .items[]
  | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | ([ $quotas.items[] | select(.metadata.namespace == $m.name) ] | length) as $count
  | select($count == 0)
  | .name
  ][]'

# Suppose the output contains tenant namespaces "team-a", "team-b".
# 2) Create a ResourceQuota manifest per tenant namespace (edit names/limits as needed)
# Run on: any machine with kubectl access

cat > team-a-resourcequota.yaml << 'EOF'
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-quota
  namespace: team-a
spec:
  hard:
    requests.cpu: "4"
    requests.memory: "8Gi"
    limits.cpu: "8"
    limits.memory: "16Gi"
    pods: "50"
    services: "20"
    configmaps: "50"
    secrets: "100"
    persistentvolumeclaims: "20"
EOF

cat > team-b-resourcequota.yaml << 'EOF'
apiVersion: v1
kind: ResourceQuota
metadata:
  name: tenant-quota
  namespace: team-b
spec:
  hard:
    requests.cpu: "4"
    requests.memory: "8Gi"
    limits.cpu: "8"
    limits.memory: "16Gi"
    pods: "50"
    services: "20"
    configmaps: "50"
    secrets: "100"
    persistentvolumeclaims: "20"
EOF

# 3) Apply the ResourceQuota objects
kubectl apply -f team-a-resourcequota.yaml
kubectl apply -f team-b-resourcequota.yaml

# 4) Verification: rerun the audit to confirm each tenant namespace has at least one ResourceQuota
{ kubectl get resourcequotas --all-namespaces -o json
  kubectl get namespaces -o json
} | jq -rs '
  .[0] as $quotas | .[1] |
  [ .items[]
  | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ $quotas.items[] | select(.metadata.namespace == $m.name) ] | length) as $count
  | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $labels == "" then "" else " labels=\($labels)" end)
    + " resourceQuotas=\($count)"
    + " is_compliant=\(if $count > 0 then "true" else "false" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

#!/usr/bin/env bash
# Purpose: Ensure every tenant namespace in an OKE cluster has at least one ResourceQuota.
# Safe to re-run. Requires: kubectl, jq in PATH, current context set.

set -euo pipefail

#-----------------------------
# Configuration
#-----------------------------
# System namespaces to exclude from tenant treatment
EXCLUDED_NAMESPACES=("kube-system" "kube-public" "kube-node-lease")

# Default ResourceQuota name to create when none exists
RQ_NAME="tenant-default-quota"

# Default quota values – adjust to fit your cluster’s sizing and SLOs
# These are example bounds only.
CPU_REQUESTS="4"
CPU_LIMITS="8"
MEMORY_REQUESTS="8Gi"
MEMORY_LIMITS="16Gi"
PODS="200"
SERVICES="50"
CONFIGMAPS="100"
SECRETS="100"
PERSISTENTVOLUMECLAIMS="50"

#-----------------------------
# Helper functions
#-----------------------------
is_excluded_ns() {
  local ns="$1"
  for e in "${EXCLUDED_NAMESPACES[@]}"; do
    if [[ "$ns" == "$e" ]]; then
      return 0
    fi
  done
  return 1
}

#-----------------------------
# Main logic
#-----------------------------
echo "Discovering namespaces..."
# Any machine with kubectl access
mapfile -t ALL_NAMESPACES < <(kubectl get namespaces -o jsonpath='{range .items[*]}{.metadata.name}{"\n"}{end}')

if [[ "${#ALL_NAMESPACES[@]}" -eq 0 ]]; then
  echo "No namespaces found, nothing to do."
  exit 0
fi

for ns in "${ALL_NAMESPACES[@]}"; do
  if is_excluded_ns "$ns"; then
    echo "Skipping excluded namespace: $ns"
    continue
  fi

  echo "Processing tenant namespace: $ns"

  # Check if any ResourceQuota exists in this namespace
  if kubectl get resourcequota -n "$ns" >/dev/null 2>&1; then
    existing_count=$(kubectl get resourcequota -n "$ns" --no-headers 2>/dev/null | wc -l || true)
  else
    existing_count=0
  fi

  if [[ "$existing_count" -gt 0 ]]; then
    echo "  Namespace $ns already has $existing_count ResourceQuota object(s); leaving as-is."
    continue
  fi

  echo "  No ResourceQuota found in $ns; creating $RQ_NAME..."

  cat <<EOF | kubectl apply -n "$ns" -f -
apiVersion: v1
kind: ResourceQuota
metadata:
  name: ${RQ_NAME}
spec:
  hard:
    requests.cpu: "${CPU_REQUESTS}"
    limits.cpu: "${CPU_LIMITS}"
    requests.memory: "${MEMORY_REQUESTS}"
    limits.memory: "${MEMORY_LIMITS}"
    pods: "${PODS}"
    services: "${SERVICES}"
    configmaps: "${CONFIGMAPS}"
    secrets: "${SECRETS}"
    persistentvolumeclaims: "${PERSISTENTVOLUMECLAIMS}"
EOF

done

#-----------------------------
# Verification
#-----------------------------
echo
echo "Verifying that each tenant namespace has at least one ResourceQuota..."

{ kubectl get resourcequotas --all-namespaces -o json
  kubectl get namespaces -o json
} | jq -rs '
  .[0] as $quotas | .[1] |
  [ .items[]
  | select(.metadata.name as $n | ["kube-system","kube-public","kube-node-lease"] | index($n) | not)
  | .metadata as $m
  | (($m.labels // {}) | to_entries | map("\(.key):\(.value)") | join(",")) as $labels
  | ([ $quotas.items[] | select(.metadata.namespace == $m.name) ] | length) as $count
  | "kind=Namespace name=\($m.name) uid=\($m.uid) apiVersion=v1"
    + (if ($m.creationTimestamp // "") == "" then "" else " created=\($m.creationTimestamp)" end)
    + (if $labels == "" then "" else " labels=\($labels)" end)
    + " resourceQuotas=\($count)"
    + " is_compliant=\(if $count > 0 then "true" else "false" end)"
  ] as $rows
  | if ($rows | length) == 0 then "is_compliant=true" else $rows[] end'

echo
echo "Automation complete."