aectann/emergency-ration-webhook repository overview

⁠emergency-ration-webhook

A Kubernetes validating admission webhook that enforces a configurable cluster capacity budget for CPU and RAM — fail-closed by design.

⁠What it does

Prevents cluster overcommit by tracking how much CPU and memory the scheduled workloads in a cluster have requested against a percentage budget of the cluster's total allocatable capacity. Any pod admission that would push a resource past its budget is rejected.

Kubernetes default scheduling only checks whether a pod fits on a node right now — it does not protect an operator-defined total headroom for the whole cluster. This webhook turns that headroom into a hard, auditable budget.

⁠Architecture

Three components, each with one job:

⁠Key properties

• Fail-closed: rejects on any unverifiable path (webhook down, stale capacity, timeout, malformed request). failurePolicy: Fail.
• Hard budget: deterministic checks against pod resources.requests. No soft limits, no heuristics.
• Prometheus metrics: admission verdicts, decision latency, cache freshness, capacity utilisation.
• Kubernetes N-2: CI-tested against k8s 1.34, 1.35, 1.36.
• Exclusion support: namespace selectors and workload-level exemptions.
• Multi-arch: linux/amd64 + linux/arm64.

⁠Usage

docker pull aectann/emergency-ration-webhook:v0.1.0

Replace the image reference in deploy/deployment.yaml, apply the manifests, and configure the budget via the Allocation CRD. See the README⁠ for full installation instructions.

⁠Source

GitHub: https://github.com/AectannArd/emergency-ration-webhook⁠

⁠License

Apache-2.0