🚨 GCP Error: 'is forbidden: exceeded quota' (ResourceQuota) — Cause, Fix, and Troubleshooting Guide

Overview

This is a Kubernetes namespace ResourceQuota rejection — not a Google Cloud quota. An admission controller blocks the object because creating it would push the namespace over a configured limit on CPU, memory, or object counts:

Error from server (Forbidden): error when creating "deploy.yaml":
pods "api-7c9f" is forbidden: exceeded quota: team-quota,
requested: requests.cpu=2, used: requests.cpu=7, limited: requests.cpu=8

The message spells out the whole equation: the quota object (team-quota), what you requested, what’s already used, and the limited ceiling.

Symptoms

• kubectl apply fails with is forbidden: exceeded quota: <name>.
• Deployments create fewer replicas than desired; new pods never appear.
• must specify requests.cpu / must specify limits.memory when a quota mandates them but the pod omits them.
• Only one namespace is affected (quotas are namespace-scoped).

Common Root Causes

1. Namespace is genuinely at its CPU/memory ceiling

Existing pods already consume most of the quota; the new request doesn’t fit.

2. Pod omits requests/limits a quota requires

If a ResourceQuota limits requests.cpu, every pod must declare requests.cpu, or admission rejects it.

3. Object-count quota hit

Limits on pods, services, configmaps, or persistentvolumeclaims counts were reached.

4. Quota set too low for the workload

The quota was provisioned for a smaller footprint than the app now needs.

How to Diagnose

All read-only.

# See the quota, its hard limits, and current usage
kubectl get resourcequota -n team-a
kubectl describe resourcequota team-quota -n team-a

# What is already consuming the quota?
kubectl get pods -n team-a \
  -o custom-columns='NAME:.metadata.name,CPU_REQ:.spec.containers[*].resources.requests.cpu'

# Confirm the incoming pod declares requests/limits
kubectl apply --dry-run=server -f deploy.yaml -n team-a

describe resourcequota shows Used vs Hard per resource — the line where Used is at Hard is the blocker.

Fixes

• Declare requests/limits on the pod so it satisfies (and fits under) the quota:

resources:
  requests:
    cpu: "500m"
    memory: "256Mi"
  limits:
    cpu: "1"
    memory: "512Mi"

• Free capacity by scaling down or removing unused workloads in the namespace.
• Raise the quota (cluster-admin) if the ceiling is genuinely too low:

kubectl edit resourcequota team-quota -n team-a
# increase spec.hard.requests.cpu / limits.memory / counts

• Split workloads across namespaces if a single team quota is too coarse.

What to Watch Out For

• This is a Kubernetes quota, not GCP project quota — raising Compute Engine CPU quota won’t help; edit the ResourceQuota object.
• If a quota tracks requests.cpu/limits.memory, pods must declare those values or they’re rejected outright — a LimitRange can supply defaults.
• Object-count quotas (pods, pvc) block creation even when CPU/memory is free — read which resource the message names.
• The error text contains the full requested / used / limited math; use it directly rather than guessing.

Related

• GCP Error: ‘0/n nodes are available: Insufficient cpu’
• GCP Error: ‘RESOURCE_EXHAUSTED: Quota exceeded’
• GCP Error: ‘Cannot evict pod (PodDisruptionBudget)’
• More in the GCP error guides.