#Configure EnvoyProxy Resource Quotas

#Overview

Use EnvoyProxyResourceQuota to limit the total CPU and memory requests declared by EnvoyProxy resources in one namespace. The quota applies to the Envoy data plane configuration that an EnvoyProxy declares; it does not replace Kubernetes ResourceQuota and does not measure the generated Envoy Deployment directly.

This feature is available in ACP 4.5 and later. It is provided by the Envoy Gateway Operator and uses the envoy-gateway.alauda.io/v1alpha1 API group.

#Quota model

EnvoyProxyResourceQuota is a namespaced resource. A quota only applies to EnvoyProxy resources in the same namespace. The first version supports the following hard limits:

The quota resource reports both the configured hard limit and the current namespace usage:

• status.hard mirrors spec.hard.
• status.used is the total usage counted for EnvoyProxy resources in the namespace.

If a namespace contains multiple quota objects, each object's status.used reports the same namespace total. Do not add the status.used values from multiple quota objects together. Each EnvoyProxy request must satisfy every quota object in its namespace.

#Create a quota

Create a quota by applying a namespaced EnvoyProxyResourceQuota resource. The following example limits the namespace to 4 CPU cores and 8 GiB of memory requests for Envoy data plane replicas:

apiVersion: envoy-gateway.alauda.io/v1alpha1
kind: EnvoyProxyResourceQuota
metadata:
  name: gateway-quota
  namespace: tenant-a
spec:
  hard:
    requests.cpu: "4"
    requests.memory: 8Gi

kubectl apply -f gateway-quota.yaml

You can create more than one quota in a namespace when different policies must be checked at the same time. An EnvoyProxy is admitted only when its resulting usage is within every quota's hard limit.

#Configure EnvoyProxy requests

The quota measures these fields in the EnvoyProxy resource:

For example, the following EnvoyProxy consumes 750m CPU and 768Mi memory from the quota:

apiVersion: gateway.envoyproxy.io/v1alpha1
kind: EnvoyProxy
metadata:
  name: gateway-proxy
  namespace: tenant-a
spec:
  provider:
    type: Kubernetes
    kubernetes:
      envoyDeployment:
        replicas: 3
        container:
          resources:
            requests:
              cpu: 250m
              memory: 256Mi

The usage calculation is:

CPU usage = replicas × envoyDeployment.container.resources.requests.cpu
Memory usage = replicas × envoyDeployment.container.resources.requests.memory

When a field is omitted, the quota uses these defaults:

The quota does not count resource limits. It also does not inspect the final Deployment generated by Envoy Gateway.

#Admission behavior

When one or more quotas exist in a namespace, the Envoy Gateway Operator validates EnvoyProxy CREATE and UPDATE requests before they are stored:

1. The existing usage of the namespace is calculated from its EnvoyProxy resources.
2. For an update, the old object's usage is replaced by the new object's usage.
3. The resulting CPU and memory usage is checked against every quota in the namespace.
4. If any hard limit would be exceeded, the request is rejected. The error identifies the quota, resource, current usage, requested usage, and hard limit.

Deleting an EnvoyProxy reduces the reported status.used after the controller reconciles the quota. A namespace with no EnvoyProxyResourceQuota objects does not impose this EnvoyProxy-specific admission limit.

#Monitor namespace usage

The quota status is the source of truth for the namespace-level total. List quotas to see the hard and used values:

kubectl get envoyproxyresourcequota -n tenant-a

The output includes these columns:

For the complete values, inspect one quota resource as YAML:

kubectl get envoyproxyresourcequota gateway-quota -n tenant-a -o yaml

The controller updates status.hard and status.used asynchronously after a quota or EnvoyProxy changes. When a namespace has multiple quotas, display the namespace usage once and show each quota's hard limit separately; do not sum the repeated CPU Used or Memory Used values.

#Scope and limitations

• This feature is available from ACP 4.5 onward.
• Only requests.cpu and requests.memory are supported.
• The quota is namespaced and only applies to EnvoyProxy resources in that namespace.
• The quota is independent of Kubernetes ResourceQuota; it does not read or update ResourceQuota.status.used.
• It does not limit resource limits.
• It does not track the final Envoy Deployment or enforce a Deployment admission policy.
• It does not support cross-namespace quotas, Gateway- or GatewayClass-specific groups, or label selectors.

#Next step

After creating a quota, configure the corresponding Gateway and its dedicated EnvoyProxy. To understand how the Envoy Gateway Operator deploys these resources, see Envoy Gateway Operator.

#Trademark Notice

Envoy® is a registered trademark of The Linux Foundation.

Alauda is an independent vendor. This product is not affiliated with, endorsed by, or sponsored by The Linux Foundation. All trademarks are the property of their respective owners and are used here for identification purposes only.