Design Resource Quotas - System Design | WinJob

Problem Statement: Multi-Tenant Resource Quota Platform

Kubernetes ResourceQuota, cloud service quotas, and internal PaaS limits all solve the same problem: cap consumption so shared infrastructure stays fair and finance stays predictable. Google, AWS, and platform interviews expect you to unify policy, usage, admission, and audit—not recite YAML snippets alone.

Problem framing

Hierarchical quotas cap CPU, memory, storage, object counts, and API rates per org, team, project, and namespace
Admission control rejects or queues workloads that would breach hard limits; soft quotas warn and throttle
Real-time usage aggregation from Kubernetes, cloud control planes, and serverless concurrency meters
Self-service portal for quota requests, approvals, and temporary burst grants with audit

Design choices

Central quota service with O(1) effective-limit lookup via materialized hierarchy
Fail-closed admission when quota plane unavailable for prod namespaces
Separate compute quotas from object count quotas (pods, LB, secrets)

Deep dive

Kubernetes, AWS, and Google interviews ask this when designing shared clusters or internal PaaS. Google Borg used quota trees; Kubernetes ResourceQuota + LimitRange are namespace-local; hyperscalers add account-level service quotas. A platform layer unifies them for FinOps and fairness.

javaOne Dark Pro

1 public final class QuotaAdmitResult {
2   private final boolean allowed;
3   private final String reason;
4   private final String reservationId;
5  
6   public static QuotaAdmitResult evaluate(
7       EffectiveQuota limit, UsageSnapshot usage, ResourceRequest req) {
8     long needed = req.cpuMillis();
9     long headroom = limit.cpuMillis() - usage.usedCpuMillis() - usage.reservedCpuMillis();
10     if (needed > headroom) {
11       return new QuotaAdmitResult(false, "QUOTA_CPU_EXCEEDED", null);
12     }
13     String resId = UUID.randomUUID().toString();
14     return new QuotaAdmitResult(true, "RESERVED", resId);
15   }
16 }

pythonOne Dark Pro

1 from dataclasses import dataclass
2  
3 @dataclass(frozen=True)
4 class AdmitResult:
5     allowed: bool
6     reason: str
7     reservation_id: str | None
8  
9 def evaluate_admit(effective, usage, request) -> AdmitResult:
10     headroom = effective.cpu - usage.used - usage.reserved
11     if request.cpu > headroom:
12         return AdmitResult(False, "QUOTA_CPU_EXCEEDED", None)
13     return AdmitResult(True, "RESERVED", str(uuid4()))

typescriptOne Dark Pro

1 interface EffectiveQuota {
2   cpuMillis: number;
3   memoryBytes: number;
4   maxPods: number;
5 }
6  
7 export function evaluateAdmit(
8   limit: EffectiveQuota,
9   used: EffectiveQuota,
10   reserved: EffectiveQuota,
11   req: EffectiveQuota,
12 ): { allowed: boolean; reason: string } {
13   const headroomCpu = limit.cpuMillis - used.cpuMillis - reserved.cpuMillis;
14   if (req.cpuMillis > headroomCpu) {
15     return { allowed: false, reason: "QUOTA_CPU_EXCEEDED" };
16   }
17   return { allowed: true, reason: "RESERVED" };
18 }

Interviewer positioning

Open with noisy neighbor and blast radius: one tenant exhausting cluster IPAM or API rate limits takes down neighbors without quotas.

How to open this one

The framing that lands for a multi-tenant resource-quota platform is admission-time enforcement of fair-share limits so one tenant cannot starve the cluster: requests and limits, per-namespace quotas, and priority/preemption classes. Lead with the noisy-neighbor problem and how quotas plus QoS classes contain it, and the failure story that proves it: a tenant without limits consumes a node's memory and the kubelet evicts other tenants' pods. That shows you understand quotas are about isolation and predictable capacity, enforced before scheduling rather than after the incident.

Key Highlights

•Hierarchical policy merges org→team→namespace
•Admit API returns actionable deny reason codes
•Usage aggregates drive chargeback and alerts

1	public final class QuotaAdmitResult {
2	private final boolean allowed;
3	private final String reason;
4	private final String reservationId;
5
6	public static QuotaAdmitResult evaluate(
7	EffectiveQuota limit, UsageSnapshot usage, ResourceRequest req) {
8	long needed = req.cpuMillis();
9	long headroom = limit.cpuMillis() - usage.usedCpuMillis() - usage.reservedCpuMillis();
10	if (needed > headroom) {
11	return new QuotaAdmitResult(false, "QUOTA_CPU_EXCEEDED", null);
12	}
13	String resId = UUID.randomUUID().toString();
14	return new QuotaAdmitResult(true, "RESERVED", resId);
15	}
16	}

1	from dataclasses import dataclass
2
3	@dataclass(frozen=True)
4	class AdmitResult:
5	allowed: bool
6	reason: str
7	reservation_id: str \| None
8
9	def evaluate_admit(effective, usage, request) -> AdmitResult:
10	headroom = effective.cpu - usage.used - usage.reserved
11	if request.cpu > headroom:
12	return AdmitResult(False, "QUOTA_CPU_EXCEEDED", None)
13	return AdmitResult(True, "RESERVED", str(uuid4()))

1	interface EffectiveQuota {
2	cpuMillis: number;
3	memoryBytes: number;
4	maxPods: number;
5	}
6
7	export function evaluateAdmit(
8	limit: EffectiveQuota,
9	used: EffectiveQuota,
10	reserved: EffectiveQuota,
11	req: EffectiveQuota,
12	): { allowed: boolean; reason: string } {
13	const headroomCpu = limit.cpuMillis - used.cpuMillis - reserved.cpuMillis;
14	if (req.cpuMillis > headroomCpu) {
15	return { allowed: false, reason: "QUOTA_CPU_EXCEEDED" };
16	}
17	return { allowed: true, reason: "RESERVED" };
18	}