## Create namespace
kubectl create namespace count-quota-test

## Apply the object-count-only quota
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: ResourceQuota
metadata:
  name: object-count-quota
  namespace: count-quota-test
spec:
  hard:
    pods: "3"
    services: "2"
    configmaps: "2"
EOF

## Verify
kubectl describe resourcequota object-count-quota -n count-quota-test

## Create pods (no resource requests needed since no CPU/memory quota)
kubectl run pod1 --image=nginx:alpine -n count-quota-test
kubectl run pod2 --image=nginx:alpine -n count-quota-test
kubectl run pod3 --image=nginx:alpine -n count-quota-test

## This 4th pod should be rejected
kubectl run pod4 --image=nginx:alpine -n count-quota-test 2>&1 || echo "Rejected: quota exceeded"

## Check usage
kubectl describe resourcequota object-count-quota -n count-quota-test

## Clean up
kubectl delete namespace count-quota-test

## Create namespace
kubectl create namespace pod-limit-test

## Create the pod-level LimitRange
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: LimitRange
metadata:
  name: pod-max-limits
  namespace: pod-limit-test
spec:
  limits:
    - type: Pod
      max:
        cpu: "1"
        memory: 1Gi
    - type: Container
      defaultRequest:
        cpu: 100m
        memory: 128Mi
      default:
        cpu: 200m
        memory: 256Mi
EOF

## This pod should work (total: 400m CPU, 512Mi memory)
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: within-limits
  namespace: pod-limit-test
spec:
  containers:
    - name: app1
      image: nginx:alpine
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 200m
          memory: 256Mi
    - name: app2
      image: nginx:alpine
      resources:
        requests:
          cpu: 100m
          memory: 128Mi
        limits:
          cpu: 200m
          memory: 256Mi
EOF
echo "Pod within-limits created successfully"

## This pod should be REJECTED (total: 1200m CPU > 1 core max)
cat <<'EOF' | kubectl apply -f - 2>&1 || echo "Rejected: exceeds pod max"
apiVersion: v1
kind: Pod
metadata:
  name: exceeds-limits
  namespace: pod-limit-test
spec:
  containers:
    - name: app1
      image: nginx:alpine
      resources:
        requests:
          cpu: 400m
          memory: 256Mi
        limits:
          cpu: 600m
          memory: 512Mi
    - name: app2
      image: nginx:alpine
      resources:
        requests:
          cpu: 400m
          memory: 256Mi
        limits:
          cpu: 600m
          memory: 512Mi
EOF

## Clean up
kubectl delete namespace pod-limit-test

## Create a test namespace with quota for demonstration
kubectl create namespace quota-monitor-test

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: ResourceQuota
metadata:
  name: test-quota
  namespace: quota-monitor-test
spec:
  hard:
    pods: "5"
    requests.cpu: "1"
    requests.memory: 1Gi
EOF

## Create some pods to use quota
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: consumer1
  namespace: quota-monitor-test
spec:
  containers:
    - name: app
      image: nginx:alpine
      resources:
        requests:
          cpu: 400m
          memory: 512Mi
        limits:
          cpu: 400m
          memory: 512Mi
EOF

## The monitoring script
cat <<'SCRIPT'
#!/bin/bash
## quota-monitor.sh - Check ResourceQuota usage across all namespaces
THRESHOLD=80

echo "=== ResourceQuota Usage Report ==="
echo ""

kubectl get resourcequota -A -o json | python3 -c "
import json, sys

data = json.load(sys.stdin)
threshold = $THRESHOLD

for item in data.get('items', []):
    ns = item['metadata']['namespace']
    name = item['metadata']['name']
    hard = item.get('status', {}).get('hard', {})
    used = item.get('status', {}).get('used', {})

    for resource in hard:
        h = hard[resource]
        u = used.get(resource, '0')

        # Parse values (simplified - handles integers and 'Mi/Gi' suffixes)
        def parse_val(v):
            v = str(v)
            if v.endswith('Gi'): return float(v[:-2]) * 1024
            if v.endswith('Mi'): return float(v[:-2])
            if v.endswith('m'): return float(v[:-1])
            try: return float(v)
            except: return 0

        hard_val = parse_val(h)
        used_val = parse_val(u)

        if hard_val > 0:
            pct = (used_val / hard_val) * 100
            status = '⚠️  WARNING' if pct >= threshold else '✅'
            print(f'{status} {ns}/{name}: {resource} = {u}/{h} ({pct:.0f}%)')
"
SCRIPT

## Clean up
kubectl delete namespace quota-monitor-test

## Create namespace
kubectl create namespace priority-quota-test

## Create PriorityClasses
cat <<'EOF' | kubectl apply -f -
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: high-priority
value: 1000
globalDefault: false
description: "High priority for critical services"
---
apiVersion: scheduling.k8s.io/v1
kind: PriorityClass
metadata:
  name: low-priority
value: 100
globalDefault: false
description: "Low priority for background jobs"
EOF

## Create scoped quotas
cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: ResourceQuota
metadata:
  name: high-priority-quota
  namespace: priority-quota-test
spec:
  hard:
    pods: "5"
  scopeSelector:
    matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["high-priority"]
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: low-priority-quota
  namespace: priority-quota-test
spec:
  hard:
    pods: "3"
  scopeSelector:
    matchExpressions:
      - operator: In
        scopeName: PriorityClass
        values: ["low-priority"]
EOF

## Verify quotas
kubectl describe resourcequota -n priority-quota-test

## Deploy high-priority pods
for i in 1 2 3; do
  kubectl run high-$i --image=nginx:alpine --priority-class-name=high-priority -n priority-quota-test
done

## Deploy low-priority pods
for i in 1 2 3; do
  kubectl run low-$i --image=nginx:alpine --priority-class-name=low-priority -n priority-quota-test
done

## This 4th low-priority pod should be rejected
kubectl run low-4 --image=nginx:alpine --priority-class-name=low-priority -n priority-quota-test 2>&1 || echo "Rejected: low-priority quota exceeded"

## Check quota usage
kubectl describe resourcequota -n priority-quota-test

## Clean up
kubectl delete namespace priority-quota-test
kubectl delete priorityclass high-priority low-priority

## Create namespace with LimitRange
kubectl create namespace defaults-test

cat <<'EOF' | kubectl apply -f -
apiVersion: v1
kind: LimitRange
metadata:
  name: container-defaults
  namespace: defaults-test
spec:
  limits:
    - type: Container
      default:
        cpu: 500m
        memory: 256Mi
      defaultRequest:
        cpu: 200m
        memory: 128Mi
EOF

## Deploy a pod WITHOUT any resource specifications
kubectl run naked-pod --image=nginx:alpine -n defaults-test

## Wait for it
kubectl wait --for=condition=Ready pod/naked-pod -n defaults-test --timeout=60s

## Inspect the pod - LimitRange should have injected defaults
kubectl get pod naked-pod -n defaults-test -o jsonpath='{.spec.containers[0].resources}' | python3 -m json.tool

## Expected output:
## {
##     "limits": {
##         "cpu": "500m",
##         "memory": "256Mi"
##     },
##     "requests": {
##         "cpu": "200m",
##         "memory": "128Mi"
##     }
## }

## Verify LimitRange is the source
kubectl describe limitrange container-defaults -n defaults-test

## Clean up
kubectl delete namespace defaults-test