[Improvement]: Enable custom resource limits per namespace

[sathindudezoysa]

Area

Terraform Modules

Current Limitation

Our current namespace is a one-size-fits-all machine. It hands out the same resource allowance to every single namespace. You can't give extra to one and less to another. it's all equal, whether that fits or not.

The Override That Goes Too Far

If you try to set a custom CPU limit, it doesn't target one namespace. it bulldozes all of them. One setting rules them all, leaving zero room for individual tweaks.

The Flawed Math

The validation check assumes every namespace eats the same portion, so it multiplies one number by the total count. But what if some need more and others less? Our module can't tell the difference. It just checks the average, not the real story.

Suggested Improvement

To support asymmetric quota distribution while maintaining project-level safety limits, the module should be refactored to accept namespace-specific configurations.

1. Refactor the namespaces variable
   Transition var.namespaces from a list(string) to a map(object) or a list of objects. This allows users to optionally specify quotas per namespace.

variable "namespaces" {
  description = "Map of namespaces to create, with optional specific quotas."
  type = map(object({
    cpu_limit       = optional(string)
    memory_limit    = optional(string)
    storage_limit   = optional(string)
  }))
  default = {}
}

2. Update the Quota Calculation Logic
   Introduce a local variable that calculates the remaining project quota after explicit namespace quotas are subtracted, and then auto-splits the remainder among any namespaces that didn't specify their own limits.

locals {
  # Example logic concept:
  # 1. Sum all explicit cpu_limits from var.namespaces.
  # 2. Subtract from var.cpu_limit.
  # 3. Divide remainder by (total_namespaces - namespaces_with_explicit_limits).
  # 4. Map the final applied limit to each namespace key.
}

3. Adjust Validation Preconditions
   Replace the multiplication-based validation with a sum-based validation to ensure the aggregate of all customized and auto-split namespaces does not exceed the project bounds.

    precondition {
      condition = (local.total_allocated_cpu <= local.project_cpu)
      error_message = "The sum of all namespace CPU limits exceeds the total project cpu_limit."
    }

4. Update the Namespace Resource
   Modify the rancher2_namespace dynamic block to fetch the calculated quota for its specific key rather than a global local variable.

  dynamic "resource_quota" {
    for_each = var.cpu_limit != null ? [1] : []
    content {
      limit {
        limits_cpu       = local.calculated_namespace_quotas[each.key].limits_cpu
        limits_memory    = local.calculated_namespace_quotas[each.key].limits_memory
        requests_storage = local.calculated_namespace_quotas[each.key].requests_storage
      }
    }
  }