Building-permits engineers cannot create new Pods because the namespace CPU budget is exhausted. Which object enforces that namespace-level ceiling at admission?
Select an answer to reveal the explanation.
Short Explanation
ResourceQuota is the namespace credit limit—when the CPU budget is spent, admission says no to new Pods. HPA scales replicas; it is not the namespace budget enforcer.
Full Explanation
Building-permits engineers who cannot create new Pods because the namespace CPU budget is exhausted are hitting ResourceQuota, which rejects new Pods that would exceed the namespace resource budget at admission. ResourceQuota enforces namespace-level aggregate ceilings for CPU, memory, object counts, and more—exactly the control that stops one team from consuming the entire municipal namespace budget during a rush of deployments.
HorizontalPodAutoscaler does not block all creates once any Pod hits maxReplicas; HPA scales a target, it is not the namespace admission ceiling. EndpointSlice does not refuse Pod registration when CPU usage is high. Mutating webhooks built into kube-scheduler that delete old ReplicaSets first is a confused distractor—the scheduler is not the ResourceQuota enforcer.
Exam caveat: quota is commonly computed from requests for CPU and memory—missing requests can interact badly with quota accounting. Operational check: kubectl describe resourcequota in the permits namespace, free or raise budget, and retry Pod creation. This distinction matters on the CKA because distractors often mix adjacent objects that sound related but solve a different control-plane problem.