support workspace resource quota

Signed-off-by: hongming <talonwan@yunify.com>

pkg/apis/addtoscheme_quota_v1alpha2.go

@@ -0,0 +1,26 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package apis
+
+import (
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+)
+
+func init() {
+	// Register the types with the Scheme so the components can map objects to GroupVersionKinds and back
+	AddToSchemes = append(AddToSchemes, quotav1alpha2.SchemeBuilder.AddToScheme)
+}

pkg/apis/quota/group.go

@@ -0,0 +1,18 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package quota contains quota API versions
+package quota

pkg/apis/quota/v1alpha2/doc.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Package v1alpha2 contains API Schema definitions for the quotas v1alpha2 API group
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=kubesphere.io/kubesphere/pkg/apis/quota
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=quota.kubesphere.io
+package v1alpha2

pkg/apis/quota/v1alpha2/register.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// NOTE: Boilerplate only. Ignore this file.
+
+// Package v1alpha2 contains API Schema definitions for the quotas v1alpha2 API group
+// +k8s:openapi-gen=true
+// +k8s:deepcopy-gen=package,register
+// +k8s:conversion-gen=kubesphere.io/kubesphere/pkg/apis/quota
+// +k8s:defaulter-gen=TypeMeta
+// +groupName=quota.kubesphere.io
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/controller-runtime/pkg/scheme"
+)
+
+var (
+	// SchemeGroupVersion is group version used to register these objects
+	SchemeGroupVersion = schema.GroupVersion{Group: "quota.kubesphere.io", Version: "v1alpha2"}
+
+	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
+	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
+
+	// AddToScheme is required by pkg/client/...
+	AddToScheme = SchemeBuilder.AddToScheme
+)
+
+// Resource is required by pkg/client/listers/...
+func Resource(resource string) schema.GroupResource {
+	return SchemeGroupVersion.WithResource(resource).GroupResource()
+}

pkg/apis/quota/v1alpha2/types.go

@@ -0,0 +1,99 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+const (
+	ResourceKindCluster      = "ResourceQuota"
+	ResourcesSingularCluster = "resourcequota"
+	ResourcesPluralCluster   = "resourcequotas"
+)
+
+func init() {
+	SchemeBuilder.Register(&ResourceQuota{}, &ResourceQuotaList{})
+}
+
+// +genclient
+// +genclient:nonNamespaced
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+// +k8s:openapi-gen=true
+
+// WorkspaceResourceQuota sets aggregate quota restrictions enforced per workspace
+// +kubebuilder:resource:categories="quota",scope="Cluster"
+// +kubebuilder:subresource:status
+type ResourceQuota struct {
+	metav1.TypeMeta `json:",inline"`
+	// Standard object's metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
+	// +optional
+	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Spec defines the desired quota
+	Spec ResourceQuotaSpec `json:"spec" protobuf:"bytes,2,opt,name=spec"`
+
+	// Status defines the actual enforced quota and its current usage
+	// +optional
+	Status ResourceQuotaStatus `json:"status,omitempty" protobuf:"bytes,3,opt,name=status"`
+}
+
+// ResourceQuotaSpec defines the desired quota restrictions
+type ResourceQuotaSpec struct {
+	// LabelSelector is used to select projects by label.
+	LabelSelector map[string]string `json:"selector" protobuf:"bytes,1,opt,name=selector"`
+
+	// Quota defines the desired quota
+	Quota corev1.ResourceQuotaSpec `json:"quota" protobuf:"bytes,2,opt,name=quota"`
+}
+
+// ResourceQuotaStatus defines the actual enforced quota and its current usage
+type ResourceQuotaStatus struct {
+	// Total defines the actual enforced quota and its current usage across all projects
+	Total corev1.ResourceQuotaStatus `json:"total" protobuf:"bytes,1,opt,name=total"`
+
+	// Namespaces slices the usage by project.
+	Namespaces ResourceQuotasStatusByNamespace `json:"namespaces" protobuf:"bytes,2,rep,name=namespaces"`
+}
+
+// ResourceQuotasStatusByNamespace bundles multiple ResourceQuotaStatusByNamespace
+type ResourceQuotasStatusByNamespace []ResourceQuotaStatusByNamespace
+
+// ResourceQuotaStatusByNamespace gives status for a particular project
+type ResourceQuotaStatusByNamespace struct {
+	corev1.ResourceQuotaStatus `json:",inline"`
+
+	// Namespace the project this status applies to
+	Namespace string `json:"namespace" protobuf:"bytes,1,opt,name=namespace"`
+}
+
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
+
+// ResourceQuotaList is a list of WorkspaceResourceQuota items.
+type ResourceQuotaList struct {
+	metav1.TypeMeta `json:",inline"`
+	// Standard list metadata.
+	// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	// +optional
+	metav1.ListMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
+
+	// Items is a list of WorkspaceResourceQuota objects.
+	// More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
+	Items []ResourceQuota `json:"items" protobuf:"bytes,2,rep,name=items"`
+}

pkg/apis/quota/v1alpha2/types_test.go

@@ -0,0 +1,64 @@
+/*
+Copyright 2019 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"testing"
+
+	"github.com/onsi/gomega"
+	"golang.org/x/net/context"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+)
+
+func TestStorageResourceQuota(t *testing.T) {
+	key := types.NamespacedName{
+		Name: "foo",
+	}
+	created := &ResourceQuota{
+		ObjectMeta: metav1.ObjectMeta{
+			Name: "foo",
+		},
+		Spec: ResourceQuotaSpec{
+			LabelSelector: map[string]string{},
+		},
+	}
+	g := gomega.NewGomegaWithT(t)
+
+	// Test Create
+	fetched := &ResourceQuota{
+		Spec: ResourceQuotaSpec{
+			LabelSelector: map[string]string{},
+		},
+	}
+	g.Expect(c.Create(context.TODO(), created)).To(gomega.Succeed())
+
+	g.Expect(c.Get(context.TODO(), key, fetched)).To(gomega.Succeed())
+	g.Expect(fetched).To(gomega.Equal(created))
+
+	// Test Updating the Labels
+	updated := fetched.DeepCopy()
+	updated.Labels = map[string]string{"hello": "world"}
+	g.Expect(c.Update(context.TODO(), updated)).To(gomega.Succeed())
+
+	g.Expect(c.Get(context.TODO(), key, fetched)).To(gomega.Succeed())
+	g.Expect(fetched).To(gomega.Equal(updated))
+
+	// Test Delete
+	g.Expect(c.Delete(context.TODO(), fetched)).To(gomega.Succeed())
+	g.Expect(c.Get(context.TODO(), key, fetched)).ToNot(gomega.Succeed())
+}

pkg/apis/quota/v1alpha2/v1alpha2_suite_test.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1alpha2
+
+import (
+	"log"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/envtest"
+)
+
+var cfg *rest.Config
+var c client.Client
+
+func TestMain(m *testing.M) {
+	t := &envtest.Environment{
+		CRDDirectoryPaths: []string{filepath.Join("..", "..", "..", "..", "config", "crds")},
+	}
+
+	err := SchemeBuilder.AddToScheme(scheme.Scheme)
+	if err != nil {
+		log.Fatal(err)
+	}
+
+	if cfg, err = t.Start(); err != nil {
+		log.Fatal(err)
+	}
+
+	if c, err = client.New(cfg, client.Options{Scheme: scheme.Scheme}); err != nil {
+		log.Fatal(err)
+	}
+
+	code := m.Run()
+	t.Stop()
+	os.Exit(code)
+}

pkg/apis/quota/v1alpha2/zz_generated.deepcopy.go

@@ -0,0 +1,167 @@
+// +build !ignore_autogenerated
+
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by controller-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	runtime "k8s.io/apimachinery/pkg/runtime"
+)
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceQuota) DeepCopyInto(out *ResourceQuota) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
+	in.Spec.DeepCopyInto(&out.Spec)
+	in.Status.DeepCopyInto(&out.Status)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuota.
+func (in *ResourceQuota) DeepCopy() *ResourceQuota {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuota)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ResourceQuota) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceQuotaList) DeepCopyInto(out *ResourceQuotaList) {
+	*out = *in
+	out.TypeMeta = in.TypeMeta
+	in.ListMeta.DeepCopyInto(&out.ListMeta)
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]ResourceQuota, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuotaList.
+func (in *ResourceQuotaList) DeepCopy() *ResourceQuotaList {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuotaList)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
+func (in *ResourceQuotaList) DeepCopyObject() runtime.Object {
+	if c := in.DeepCopy(); c != nil {
+		return c
+	}
+	return nil
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceQuotaSpec) DeepCopyInto(out *ResourceQuotaSpec) {
+	*out = *in
+	if in.LabelSelector != nil {
+		in, out := &in.LabelSelector, &out.LabelSelector
+		*out = make(map[string]string, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
+	in.Quota.DeepCopyInto(&out.Quota)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuotaSpec.
+func (in *ResourceQuotaSpec) DeepCopy() *ResourceQuotaSpec {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuotaSpec)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceQuotaStatus) DeepCopyInto(out *ResourceQuotaStatus) {
+	*out = *in
+	in.Total.DeepCopyInto(&out.Total)
+	if in.Namespaces != nil {
+		in, out := &in.Namespaces, &out.Namespaces
+		*out = make(ResourceQuotasStatusByNamespace, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuotaStatus.
+func (in *ResourceQuotaStatus) DeepCopy() *ResourceQuotaStatus {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuotaStatus)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *ResourceQuotaStatusByNamespace) DeepCopyInto(out *ResourceQuotaStatusByNamespace) {
+	*out = *in
+	in.ResourceQuotaStatus.DeepCopyInto(&out.ResourceQuotaStatus)
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuotaStatusByNamespace.
+func (in *ResourceQuotaStatusByNamespace) DeepCopy() *ResourceQuotaStatusByNamespace {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuotaStatusByNamespace)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in ResourceQuotasStatusByNamespace) DeepCopyInto(out *ResourceQuotasStatusByNamespace) {
+	{
+		in := &in
+		*out = make(ResourceQuotasStatusByNamespace, len(*in))
+		for i := range *in {
+			(*in)[i].DeepCopyInto(&(*out)[i])
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceQuotasStatusByNamespace.
+func (in ResourceQuotasStatusByNamespace) DeepCopy() ResourceQuotasStatusByNamespace {
+	if in == nil {
+		return nil
+	}
+	out := new(ResourceQuotasStatusByNamespace)
+	in.DeepCopyInto(out)
+	return *out
+}

pkg/client/clientset/versioned/clientset.go

@@ -30,6 +30,7 @@ import (
 	devopsv1alpha3 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/devops/v1alpha3"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/iam/v1alpha2"
 	networkv1alpha1 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/network/v1alpha1"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/quota/v1alpha2"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2"
 	storagev1alpha1 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/storage/v1alpha1"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/tenant/v1alpha1"
@@ -45,6 +46,7 @@ type Interface interface {
 	DevopsV1alpha3() devopsv1alpha3.DevopsV1alpha3Interface
 	IamV1alpha2() iamv1alpha2.IamV1alpha2Interface
 	NetworkV1alpha1() networkv1alpha1.NetworkV1alpha1Interface
+	QuotaV1alpha2() quotav1alpha2.QuotaV1alpha2Interface
 	ServicemeshV1alpha2() servicemeshv1alpha2.ServicemeshV1alpha2Interface
 	StorageV1alpha1() storagev1alpha1.StorageV1alpha1Interface
 	TenantV1alpha1() tenantv1alpha1.TenantV1alpha1Interface
@@ -62,6 +64,7 @@ type Clientset struct {
 	devopsV1alpha3      *devopsv1alpha3.DevopsV1alpha3Client
 	iamV1alpha2         *iamv1alpha2.IamV1alpha2Client
 	networkV1alpha1     *networkv1alpha1.NetworkV1alpha1Client
+	quotaV1alpha2       *quotav1alpha2.QuotaV1alpha2Client
 	servicemeshV1alpha2 *servicemeshv1alpha2.ServicemeshV1alpha2Client
 	storageV1alpha1     *storagev1alpha1.StorageV1alpha1Client
 	tenantV1alpha1      *tenantv1alpha1.TenantV1alpha1Client
@@ -99,6 +102,11 @@ func (c *Clientset) NetworkV1alpha1() networkv1alpha1.NetworkV1alpha1Interface {
 	return c.networkV1alpha1
 }
 
+// QuotaV1alpha2 retrieves the QuotaV1alpha2Client
+func (c *Clientset) QuotaV1alpha2() quotav1alpha2.QuotaV1alpha2Interface {
+	return c.quotaV1alpha2
+}
+
 // ServicemeshV1alpha2 retrieves the ServicemeshV1alpha2Client
 func (c *Clientset) ServicemeshV1alpha2() servicemeshv1alpha2.ServicemeshV1alpha2Interface {
 	return c.servicemeshV1alpha2
@@ -169,6 +177,10 @@ func NewForConfig(c *rest.Config) (*Clientset, error) {
 	if err != nil {
 		return nil, err
 	}
+	cs.quotaV1alpha2, err = quotav1alpha2.NewForConfig(&configShallowCopy)
+	if err != nil {
+		return nil, err
+	}
 	cs.servicemeshV1alpha2, err = servicemeshv1alpha2.NewForConfig(&configShallowCopy)
 	if err != nil {
 		return nil, err
@@ -207,6 +219,7 @@ func NewForConfigOrDie(c *rest.Config) *Clientset {
 	cs.devopsV1alpha3 = devopsv1alpha3.NewForConfigOrDie(c)
 	cs.iamV1alpha2 = iamv1alpha2.NewForConfigOrDie(c)
 	cs.networkV1alpha1 = networkv1alpha1.NewForConfigOrDie(c)
+	cs.quotaV1alpha2 = quotav1alpha2.NewForConfigOrDie(c)
 	cs.servicemeshV1alpha2 = servicemeshv1alpha2.NewForConfigOrDie(c)
 	cs.storageV1alpha1 = storagev1alpha1.NewForConfigOrDie(c)
 	cs.tenantV1alpha1 = tenantv1alpha1.NewForConfigOrDie(c)
@@ -226,6 +239,7 @@ func New(c rest.Interface) *Clientset {
 	cs.devopsV1alpha3 = devopsv1alpha3.New(c)
 	cs.iamV1alpha2 = iamv1alpha2.New(c)
 	cs.networkV1alpha1 = networkv1alpha1.New(c)
+	cs.quotaV1alpha2 = quotav1alpha2.New(c)
 	cs.servicemeshV1alpha2 = servicemeshv1alpha2.New(c)
 	cs.storageV1alpha1 = storagev1alpha1.New(c)
 	cs.tenantV1alpha1 = tenantv1alpha1.New(c)

pkg/client/clientset/versioned/fake/clientset_generated.go

@@ -37,6 +37,8 @@ import (
 	fakeiamv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/iam/v1alpha2/fake"
 	networkv1alpha1 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/network/v1alpha1"
 	fakenetworkv1alpha1 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/network/v1alpha1/fake"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/quota/v1alpha2"
+	fakequotav1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/quota/v1alpha2/fake"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2"
 	fakeservicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/servicemesh/v1alpha2/fake"
 	storagev1alpha1 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/storage/v1alpha1"
@@ -126,6 +128,11 @@ func (c *Clientset) NetworkV1alpha1() networkv1alpha1.NetworkV1alpha1Interface {
 	return &fakenetworkv1alpha1.FakeNetworkV1alpha1{Fake: &c.Fake}
 }
 
+// QuotaV1alpha2 retrieves the QuotaV1alpha2Client
+func (c *Clientset) QuotaV1alpha2() quotav1alpha2.QuotaV1alpha2Interface {
+	return &fakequotav1alpha2.FakeQuotaV1alpha2{Fake: &c.Fake}
+}
+
 // ServicemeshV1alpha2 retrieves the ServicemeshV1alpha2Client
 func (c *Clientset) ServicemeshV1alpha2() servicemeshv1alpha2.ServicemeshV1alpha2Interface {
 	return &fakeservicemeshv1alpha2.FakeServicemeshV1alpha2{Fake: &c.Fake}

pkg/client/clientset/versioned/fake/register.go

@@ -30,6 +30,7 @@ import (
 	devopsv1alpha3 "kubesphere.io/kubesphere/pkg/apis/devops/v1alpha3"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	networkv1alpha1 "kubesphere.io/kubesphere/pkg/apis/network/v1alpha1"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
 	storagev1alpha1 "kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
@@ -47,6 +48,7 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	devopsv1alpha3.AddToScheme,
 	iamv1alpha2.AddToScheme,
 	networkv1alpha1.AddToScheme,
+	quotav1alpha2.AddToScheme,
 	servicemeshv1alpha2.AddToScheme,
 	storagev1alpha1.AddToScheme,
 	tenantv1alpha1.AddToScheme,

pkg/client/clientset/versioned/scheme/register.go

@@ -30,6 +30,7 @@ import (
 	devopsv1alpha3 "kubesphere.io/kubesphere/pkg/apis/devops/v1alpha3"
 	iamv1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	networkv1alpha1 "kubesphere.io/kubesphere/pkg/apis/network/v1alpha1"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
 	storagev1alpha1 "kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
@@ -47,6 +48,7 @@ var localSchemeBuilder = runtime.SchemeBuilder{
 	devopsv1alpha3.AddToScheme,
 	iamv1alpha2.AddToScheme,
 	networkv1alpha1.AddToScheme,
+	quotav1alpha2.AddToScheme,
 	servicemeshv1alpha2.AddToScheme,
 	storagev1alpha1.AddToScheme,
 	tenantv1alpha1.AddToScheme,

pkg/client/clientset/versioned/typed/quota/v1alpha2/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// This package has the automatically generated typed clients.
+package v1alpha2

pkg/client/clientset/versioned/typed/quota/v1alpha2/fake/doc.go

@@ -0,0 +1,20 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+// Package fake has the automatically generated clients.
+package fake

pkg/client/clientset/versioned/typed/quota/v1alpha2/fake/fake_quota_client.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	rest "k8s.io/client-go/rest"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/clientset/versioned/typed/quota/v1alpha2"
+)
+
+type FakeQuotaV1alpha2 struct {
+	*testing.Fake
+}
+
+func (c *FakeQuotaV1alpha2) ResourceQuotas() v1alpha2.ResourceQuotaInterface {
+	return &FakeResourceQuotas{c}
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *FakeQuotaV1alpha2) RESTClient() rest.Interface {
+	var ret *rest.RESTClient
+	return ret
+}

pkg/client/clientset/versioned/typed/quota/v1alpha2/fake/fake_resourcequota.go

@@ -0,0 +1,133 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package fake
+
+import (
+	"context"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	labels "k8s.io/apimachinery/pkg/labels"
+	schema "k8s.io/apimachinery/pkg/runtime/schema"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	testing "k8s.io/client-go/testing"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+)
+
+// FakeResourceQuotas implements ResourceQuotaInterface
+type FakeResourceQuotas struct {
+	Fake *FakeQuotaV1alpha2
+}
+
+var resourcequotasResource = schema.GroupVersionResource{Group: "quota.kubesphere.io", Version: "v1alpha2", Resource: "resourcequotas"}
+
+var resourcequotasKind = schema.GroupVersionKind{Group: "quota.kubesphere.io", Version: "v1alpha2", Kind: "ResourceQuota"}
+
+// Get takes name of the resourceQuota, and returns the corresponding resourceQuota object, and an error if there is any.
+func (c *FakeResourceQuotas) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha2.ResourceQuota, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootGetAction(resourcequotasResource, name), &v1alpha2.ResourceQuota{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.ResourceQuota), err
+}
+
+// List takes label and field selectors, and returns the list of ResourceQuotas that match those selectors.
+func (c *FakeResourceQuotas) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha2.ResourceQuotaList, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootListAction(resourcequotasResource, resourcequotasKind, opts), &v1alpha2.ResourceQuotaList{})
+	if obj == nil {
+		return nil, err
+	}
+
+	label, _, _ := testing.ExtractFromListOptions(opts)
+	if label == nil {
+		label = labels.Everything()
+	}
+	list := &v1alpha2.ResourceQuotaList{ListMeta: obj.(*v1alpha2.ResourceQuotaList).ListMeta}
+	for _, item := range obj.(*v1alpha2.ResourceQuotaList).Items {
+		if label.Matches(labels.Set(item.Labels)) {
+			list.Items = append(list.Items, item)
+		}
+	}
+	return list, err
+}
+
+// Watch returns a watch.Interface that watches the requested resourceQuotas.
+func (c *FakeResourceQuotas) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	return c.Fake.
+		InvokesWatch(testing.NewRootWatchAction(resourcequotasResource, opts))
+}
+
+// Create takes the representation of a resourceQuota and creates it.  Returns the server's representation of the resourceQuota, and an error, if there is any.
+func (c *FakeResourceQuotas) Create(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.CreateOptions) (result *v1alpha2.ResourceQuota, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootCreateAction(resourcequotasResource, resourceQuota), &v1alpha2.ResourceQuota{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.ResourceQuota), err
+}
+
+// Update takes the representation of a resourceQuota and updates it. Returns the server's representation of the resourceQuota, and an error, if there is any.
+func (c *FakeResourceQuotas) Update(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.UpdateOptions) (result *v1alpha2.ResourceQuota, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateAction(resourcequotasResource, resourceQuota), &v1alpha2.ResourceQuota{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.ResourceQuota), err
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *FakeResourceQuotas) UpdateStatus(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.UpdateOptions) (*v1alpha2.ResourceQuota, error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootUpdateSubresourceAction(resourcequotasResource, "status", resourceQuota), &v1alpha2.ResourceQuota{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.ResourceQuota), err
+}
+
+// Delete takes name of the resourceQuota and deletes it. Returns an error if one occurs.
+func (c *FakeResourceQuotas) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	_, err := c.Fake.
+		Invokes(testing.NewRootDeleteAction(resourcequotasResource, name), &v1alpha2.ResourceQuota{})
+	return err
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *FakeResourceQuotas) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	action := testing.NewRootDeleteCollectionAction(resourcequotasResource, listOpts)
+
+	_, err := c.Fake.Invokes(action, &v1alpha2.ResourceQuotaList{})
+	return err
+}
+
+// Patch applies the patch and returns the patched resourceQuota.
+func (c *FakeResourceQuotas) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha2.ResourceQuota, err error) {
+	obj, err := c.Fake.
+		Invokes(testing.NewRootPatchSubresourceAction(resourcequotasResource, name, pt, data, subresources...), &v1alpha2.ResourceQuota{})
+	if obj == nil {
+		return nil, err
+	}
+	return obj.(*v1alpha2.ResourceQuota), err
+}

pkg/client/clientset/versioned/typed/quota/v1alpha2/generated_expansion.go

@@ -0,0 +1,21 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+type ResourceQuotaExpansion interface{}

pkg/client/clientset/versioned/typed/quota/v1alpha2/quota_client.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	"kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
+)
+
+type QuotaV1alpha2Interface interface {
+	RESTClient() rest.Interface
+	ResourceQuotasGetter
+}
+
+// QuotaV1alpha2Client is used to interact with features provided by the quota.kubesphere.io group.
+type QuotaV1alpha2Client struct {
+	restClient rest.Interface
+}
+
+func (c *QuotaV1alpha2Client) ResourceQuotas() ResourceQuotaInterface {
+	return newResourceQuotas(c)
+}
+
+// NewForConfig creates a new QuotaV1alpha2Client for the given config.
+func NewForConfig(c *rest.Config) (*QuotaV1alpha2Client, error) {
+	config := *c
+	if err := setConfigDefaults(&config); err != nil {
+		return nil, err
+	}
+	client, err := rest.RESTClientFor(&config)
+	if err != nil {
+		return nil, err
+	}
+	return &QuotaV1alpha2Client{client}, nil
+}
+
+// NewForConfigOrDie creates a new QuotaV1alpha2Client for the given config and
+// panics if there is an error in the config.
+func NewForConfigOrDie(c *rest.Config) *QuotaV1alpha2Client {
+	client, err := NewForConfig(c)
+	if err != nil {
+		panic(err)
+	}
+	return client
+}
+
+// New creates a new QuotaV1alpha2Client for the given RESTClient.
+func New(c rest.Interface) *QuotaV1alpha2Client {
+	return &QuotaV1alpha2Client{c}
+}
+
+func setConfigDefaults(config *rest.Config) error {
+	gv := v1alpha2.SchemeGroupVersion
+	config.GroupVersion = &gv
+	config.APIPath = "/apis"
+	config.NegotiatedSerializer = scheme.Codecs.WithoutConversion()
+
+	if config.UserAgent == "" {
+		config.UserAgent = rest.DefaultKubernetesUserAgent()
+	}
+
+	return nil
+}
+
+// RESTClient returns a RESTClient that is used to communicate
+// with API server by this client implementation.
+func (c *QuotaV1alpha2Client) RESTClient() rest.Interface {
+	if c == nil {
+		return nil
+	}
+	return c.restClient
+}

pkg/client/clientset/versioned/typed/quota/v1alpha2/resourcequota.go

@@ -0,0 +1,184 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by client-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"context"
+	"time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	types "k8s.io/apimachinery/pkg/types"
+	watch "k8s.io/apimachinery/pkg/watch"
+	rest "k8s.io/client-go/rest"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	scheme "kubesphere.io/kubesphere/pkg/client/clientset/versioned/scheme"
+)
+
+// ResourceQuotasGetter has a method to return a ResourceQuotaInterface.
+// A group's client should implement this interface.
+type ResourceQuotasGetter interface {
+	ResourceQuotas() ResourceQuotaInterface
+}
+
+// ResourceQuotaInterface has methods to work with ResourceQuota resources.
+type ResourceQuotaInterface interface {
+	Create(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.CreateOptions) (*v1alpha2.ResourceQuota, error)
+	Update(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.UpdateOptions) (*v1alpha2.ResourceQuota, error)
+	UpdateStatus(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.UpdateOptions) (*v1alpha2.ResourceQuota, error)
+	Delete(ctx context.Context, name string, opts v1.DeleteOptions) error
+	DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error
+	Get(ctx context.Context, name string, opts v1.GetOptions) (*v1alpha2.ResourceQuota, error)
+	List(ctx context.Context, opts v1.ListOptions) (*v1alpha2.ResourceQuotaList, error)
+	Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error)
+	Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha2.ResourceQuota, err error)
+	ResourceQuotaExpansion
+}
+
+// resourceQuotas implements ResourceQuotaInterface
+type resourceQuotas struct {
+	client rest.Interface
+}
+
+// newResourceQuotas returns a ResourceQuotas
+func newResourceQuotas(c *QuotaV1alpha2Client) *resourceQuotas {
+	return &resourceQuotas{
+		client: c.RESTClient(),
+	}
+}
+
+// Get takes name of the resourceQuota, and returns the corresponding resourceQuota object, and an error if there is any.
+func (c *resourceQuotas) Get(ctx context.Context, name string, options v1.GetOptions) (result *v1alpha2.ResourceQuota, err error) {
+	result = &v1alpha2.ResourceQuota{}
+	err = c.client.Get().
+		Resource("resourcequotas").
+		Name(name).
+		VersionedParams(&options, scheme.ParameterCodec).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// List takes label and field selectors, and returns the list of ResourceQuotas that match those selectors.
+func (c *resourceQuotas) List(ctx context.Context, opts v1.ListOptions) (result *v1alpha2.ResourceQuotaList, err error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	result = &v1alpha2.ResourceQuotaList{}
+	err = c.client.Get().
+		Resource("resourcequotas").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Watch returns a watch.Interface that watches the requested resourceQuotas.
+func (c *resourceQuotas) Watch(ctx context.Context, opts v1.ListOptions) (watch.Interface, error) {
+	var timeout time.Duration
+	if opts.TimeoutSeconds != nil {
+		timeout = time.Duration(*opts.TimeoutSeconds) * time.Second
+	}
+	opts.Watch = true
+	return c.client.Get().
+		Resource("resourcequotas").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Watch(ctx)
+}
+
+// Create takes the representation of a resourceQuota and creates it.  Returns the server's representation of the resourceQuota, and an error, if there is any.
+func (c *resourceQuotas) Create(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.CreateOptions) (result *v1alpha2.ResourceQuota, err error) {
+	result = &v1alpha2.ResourceQuota{}
+	err = c.client.Post().
+		Resource("resourcequotas").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(resourceQuota).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Update takes the representation of a resourceQuota and updates it. Returns the server's representation of the resourceQuota, and an error, if there is any.
+func (c *resourceQuotas) Update(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.UpdateOptions) (result *v1alpha2.ResourceQuota, err error) {
+	result = &v1alpha2.ResourceQuota{}
+	err = c.client.Put().
+		Resource("resourcequotas").
+		Name(resourceQuota.Name).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(resourceQuota).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// UpdateStatus was generated because the type contains a Status member.
+// Add a +genclient:noStatus comment above the type to avoid generating UpdateStatus().
+func (c *resourceQuotas) UpdateStatus(ctx context.Context, resourceQuota *v1alpha2.ResourceQuota, opts v1.UpdateOptions) (result *v1alpha2.ResourceQuota, err error) {
+	result = &v1alpha2.ResourceQuota{}
+	err = c.client.Put().
+		Resource("resourcequotas").
+		Name(resourceQuota.Name).
+		SubResource("status").
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(resourceQuota).
+		Do(ctx).
+		Into(result)
+	return
+}
+
+// Delete takes name of the resourceQuota and deletes it. Returns an error if one occurs.
+func (c *resourceQuotas) Delete(ctx context.Context, name string, opts v1.DeleteOptions) error {
+	return c.client.Delete().
+		Resource("resourcequotas").
+		Name(name).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// DeleteCollection deletes a collection of objects.
+func (c *resourceQuotas) DeleteCollection(ctx context.Context, opts v1.DeleteOptions, listOpts v1.ListOptions) error {
+	var timeout time.Duration
+	if listOpts.TimeoutSeconds != nil {
+		timeout = time.Duration(*listOpts.TimeoutSeconds) * time.Second
+	}
+	return c.client.Delete().
+		Resource("resourcequotas").
+		VersionedParams(&listOpts, scheme.ParameterCodec).
+		Timeout(timeout).
+		Body(&opts).
+		Do(ctx).
+		Error()
+}
+
+// Patch applies the patch and returns the patched resourceQuota.
+func (c *resourceQuotas) Patch(ctx context.Context, name string, pt types.PatchType, data []byte, opts v1.PatchOptions, subresources ...string) (result *v1alpha2.ResourceQuota, err error) {
+	result = &v1alpha2.ResourceQuota{}
+	err = c.client.Patch(pt).
+		Resource("resourcequotas").
+		Name(name).
+		SubResource(subresources...).
+		VersionedParams(&opts, scheme.ParameterCodec).
+		Body(data).
+		Do(ctx).
+		Into(result)
+	return
+}

pkg/client/informers/externalversions/factory.go

@@ -34,6 +34,7 @@ import (
 	iam "kubesphere.io/kubesphere/pkg/client/informers/externalversions/iam"
 	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
 	network "kubesphere.io/kubesphere/pkg/client/informers/externalversions/network"
+	quota "kubesphere.io/kubesphere/pkg/client/informers/externalversions/quota"
 	servicemesh "kubesphere.io/kubesphere/pkg/client/informers/externalversions/servicemesh"
 	storage "kubesphere.io/kubesphere/pkg/client/informers/externalversions/storage"
 	tenant "kubesphere.io/kubesphere/pkg/client/informers/externalversions/tenant"
@@ -185,6 +186,7 @@ type SharedInformerFactory interface {
 	Devops() devops.Interface
 	Iam() iam.Interface
 	Network() network.Interface
+	Quota() quota.Interface
 	Servicemesh() servicemesh.Interface
 	Storage() storage.Interface
 	Tenant() tenant.Interface
@@ -211,6 +213,10 @@ func (f *sharedInformerFactory) Network() network.Interface {
 	return network.New(f, f.namespace, f.tweakListOptions)
 }
 
+func (f *sharedInformerFactory) Quota() quota.Interface {
+	return quota.New(f, f.namespace, f.tweakListOptions)
+}
+
 func (f *sharedInformerFactory) Servicemesh() servicemesh.Interface {
 	return servicemesh.New(f, f.namespace, f.tweakListOptions)
 }

pkg/client/informers/externalversions/generic.go

@@ -29,6 +29,7 @@ import (
 	v1alpha3 "kubesphere.io/kubesphere/pkg/apis/devops/v1alpha3"
 	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/iam/v1alpha2"
 	networkv1alpha1 "kubesphere.io/kubesphere/pkg/apis/network/v1alpha1"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
 	servicemeshv1alpha2 "kubesphere.io/kubesphere/pkg/apis/servicemesh/v1alpha2"
 	storagev1alpha1 "kubesphere.io/kubesphere/pkg/apis/storage/v1alpha1"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
@@ -118,6 +119,10 @@ func (f *sharedInformerFactory) ForResource(resource schema.GroupVersionResource
 	case networkv1alpha1.SchemeGroupVersion.WithResource("namespacenetworkpolicies"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Network().V1alpha1().NamespaceNetworkPolicies().Informer()}, nil
 
+		// Group=quota.kubesphere.io, Version=v1alpha2
+	case quotav1alpha2.SchemeGroupVersion.WithResource("resourcequotas"):
+		return &genericInformer{resource: resource.GroupResource(), informer: f.Quota().V1alpha2().ResourceQuotas().Informer()}, nil
+
 		// Group=servicemesh.kubesphere.io, Version=v1alpha2
 	case servicemeshv1alpha2.SchemeGroupVersion.WithResource("servicepolicies"):
 		return &genericInformer{resource: resource.GroupResource(), informer: f.Servicemesh().V1alpha2().ServicePolicies().Informer()}, nil

pkg/client/informers/externalversions/quota/interface.go

@@ -0,0 +1,46 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package quota
+
+import (
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/informers/externalversions/quota/v1alpha2"
+)
+
+// Interface provides access to each of this group's versions.
+type Interface interface {
+	// V1alpha2 provides access to shared informers for resources in V1alpha2.
+	V1alpha2() v1alpha2.Interface
+}
+
+type group struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &group{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// V1alpha2 returns a new v1alpha2.Interface.
+func (g *group) V1alpha2() v1alpha2.Interface {
+	return v1alpha2.New(g.factory, g.namespace, g.tweakListOptions)
+}

pkg/client/informers/externalversions/quota/v1alpha2/interface.go

@@ -0,0 +1,45 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+)
+
+// Interface provides access to all the informers in this group version.
+type Interface interface {
+	// ResourceQuotas returns a ResourceQuotaInformer.
+	ResourceQuotas() ResourceQuotaInformer
+}
+
+type version struct {
+	factory          internalinterfaces.SharedInformerFactory
+	namespace        string
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// New returns a new Interface.
+func New(f internalinterfaces.SharedInformerFactory, namespace string, tweakListOptions internalinterfaces.TweakListOptionsFunc) Interface {
+	return &version{factory: f, namespace: namespace, tweakListOptions: tweakListOptions}
+}
+
+// ResourceQuotas returns a ResourceQuotaInformer.
+func (v *version) ResourceQuotas() ResourceQuotaInformer {
+	return &resourceQuotaInformer{factory: v.factory, tweakListOptions: v.tweakListOptions}
+}

pkg/client/informers/externalversions/quota/v1alpha2/resourcequota.go

@@ -0,0 +1,89 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by informer-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"context"
+	time "time"
+
+	v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	runtime "k8s.io/apimachinery/pkg/runtime"
+	watch "k8s.io/apimachinery/pkg/watch"
+	cache "k8s.io/client-go/tools/cache"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	versioned "kubesphere.io/kubesphere/pkg/client/clientset/versioned"
+	internalinterfaces "kubesphere.io/kubesphere/pkg/client/informers/externalversions/internalinterfaces"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/client/listers/quota/v1alpha2"
+)
+
+// ResourceQuotaInformer provides access to a shared informer and lister for
+// ResourceQuotas.
+type ResourceQuotaInformer interface {
+	Informer() cache.SharedIndexInformer
+	Lister() v1alpha2.ResourceQuotaLister
+}
+
+type resourceQuotaInformer struct {
+	factory          internalinterfaces.SharedInformerFactory
+	tweakListOptions internalinterfaces.TweakListOptionsFunc
+}
+
+// NewResourceQuotaInformer constructs a new informer for ResourceQuota type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewResourceQuotaInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers) cache.SharedIndexInformer {
+	return NewFilteredResourceQuotaInformer(client, resyncPeriod, indexers, nil)
+}
+
+// NewFilteredResourceQuotaInformer constructs a new informer for ResourceQuota type.
+// Always prefer using an informer factory to get a shared informer instead of getting an independent
+// one. This reduces memory footprint and number of connections to the server.
+func NewFilteredResourceQuotaInformer(client versioned.Interface, resyncPeriod time.Duration, indexers cache.Indexers, tweakListOptions internalinterfaces.TweakListOptionsFunc) cache.SharedIndexInformer {
+	return cache.NewSharedIndexInformer(
+		&cache.ListWatch{
+			ListFunc: func(options v1.ListOptions) (runtime.Object, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.QuotaV1alpha2().ResourceQuotas().List(context.TODO(), options)
+			},
+			WatchFunc: func(options v1.ListOptions) (watch.Interface, error) {
+				if tweakListOptions != nil {
+					tweakListOptions(&options)
+				}
+				return client.QuotaV1alpha2().ResourceQuotas().Watch(context.TODO(), options)
+			},
+		},
+		&quotav1alpha2.ResourceQuota{},
+		resyncPeriod,
+		indexers,
+	)
+}
+
+func (f *resourceQuotaInformer) defaultInformer(client versioned.Interface, resyncPeriod time.Duration) cache.SharedIndexInformer {
+	return NewFilteredResourceQuotaInformer(client, resyncPeriod, cache.Indexers{cache.NamespaceIndex: cache.MetaNamespaceIndexFunc}, f.tweakListOptions)
+}
+
+func (f *resourceQuotaInformer) Informer() cache.SharedIndexInformer {
+	return f.factory.InformerFor(&quotav1alpha2.ResourceQuota{}, f.defaultInformer)
+}
+
+func (f *resourceQuotaInformer) Lister() v1alpha2.ResourceQuotaLister {
+	return v1alpha2.NewResourceQuotaLister(f.Informer().GetIndexer())
+}

pkg/client/listers/quota/v1alpha2/expansion_generated.go

@@ -0,0 +1,23 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+// ResourceQuotaListerExpansion allows custom methods to be added to
+// ResourceQuotaLister.
+type ResourceQuotaListerExpansion interface{}

pkg/client/listers/quota/v1alpha2/resourcequota.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2020 The KubeSphere Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+// Code generated by lister-gen. DO NOT EDIT.
+
+package v1alpha2
+
+import (
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/client-go/tools/cache"
+	v1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+)
+
+// ResourceQuotaLister helps list ResourceQuotas.
+type ResourceQuotaLister interface {
+	// List lists all ResourceQuotas in the indexer.
+	List(selector labels.Selector) (ret []*v1alpha2.ResourceQuota, err error)
+	// Get retrieves the ResourceQuota from the index for a given name.
+	Get(name string) (*v1alpha2.ResourceQuota, error)
+	ResourceQuotaListerExpansion
+}
+
+// resourceQuotaLister implements the ResourceQuotaLister interface.
+type resourceQuotaLister struct {
+	indexer cache.Indexer
+}
+
+// NewResourceQuotaLister returns a new ResourceQuotaLister.
+func NewResourceQuotaLister(indexer cache.Indexer) ResourceQuotaLister {
+	return &resourceQuotaLister{indexer: indexer}
+}
+
+// List lists all ResourceQuotas in the indexer.
+func (s *resourceQuotaLister) List(selector labels.Selector) (ret []*v1alpha2.ResourceQuota, err error) {
+	err = cache.ListAll(s.indexer, selector, func(m interface{}) {
+		ret = append(ret, m.(*v1alpha2.ResourceQuota))
+	})
+	return ret, err
+}
+
+// Get retrieves the ResourceQuota from the index for a given name.
+func (s *resourceQuotaLister) Get(name string) (*v1alpha2.ResourceQuota, error) {
+	obj, exists, err := s.indexer.GetByKey(name)
+	if err != nil {
+		return nil, err
+	}
+	if !exists {
+		return nil, errors.NewNotFound(v1alpha2.Resource("resourcequota"), name)
+	}
+	return obj.(*v1alpha2.ResourceQuota), nil
+}

pkg/controller/quota/accessor.go

@@ -0,0 +1,206 @@
+/*
+
+ Copyright 2021 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package quota
+
+import (
+	"context"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/klog"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"time"
+
+	lru "github.com/hashicorp/golang-lru"
+
+	corev1 "k8s.io/api/core/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	utilwait "k8s.io/apimachinery/pkg/util/wait"
+	etcd "k8s.io/apiserver/pkg/storage/etcd3"
+	utilquota "kubesphere.io/kubesphere/kube/pkg/quota/v1"
+)
+
+// Following code copied from github.com/openshift/apiserver-library-go/pkg/admission/quota/clusterresourcequota
+
+type accessor struct {
+	client client.Client
+
+	// updatedResourceQuotas holds a cache of quotas that we've updated.  This is used to pull the "really latest" during back to
+	// back quota evaluations that touch the same quota doc.  This only works because we can compare etcd resourceVersions
+	// for the same resource as integers.  Before this change: 22 updates with 12 conflicts.  after this change: 15 updates with 0 conflicts
+	updatedResourceQuotas *lru.Cache
+}
+
+// newQuotaAccessor creates an object that conforms to the QuotaAccessor interface to be used to retrieve quota objects.
+func newQuotaAccessor(client client.Client) *accessor {
+	updatedCache, err := lru.New(100)
+	if err != nil {
+		// this should never happen
+		panic(err)
+	}
+
+	return &accessor{
+		client:                client,
+		updatedResourceQuotas: updatedCache,
+	}
+}
+
+// UpdateQuotaStatus the newQuota coming in will be incremented from the original.  The difference between the original
+// and the new is the amount to add to the namespace total, but the total status is the used value itself
+func (a *accessor) UpdateQuotaStatus(newQuota *corev1.ResourceQuota) error {
+	// skipping namespaced resource quota
+	if newQuota.APIVersion != quotav1alpha2.SchemeGroupVersion.String() {
+		klog.V(6).Infof("skipping namespaced resource quota %v %v", newQuota.Namespace, newQuota.Name)
+		return nil
+	}
+	ctx := context.TODO()
+	resourceQuota := &quotav1alpha2.ResourceQuota{}
+	err := a.client.Get(ctx, types.NamespacedName{Name: newQuota.Name}, resourceQuota)
+	if err != nil {
+		klog.Errorf("failed to fetch resource quota: %s, %v", newQuota.Name, err)
+		return err
+	}
+	resourceQuota = a.checkCache(resourceQuota)
+
+	// re-assign objectmeta
+	// make a copy
+	updatedQuota := resourceQuota.DeepCopy()
+	updatedQuota.ObjectMeta = newQuota.ObjectMeta
+	updatedQuota.Namespace = ""
+
+	// determine change in usage
+	usageDiff := utilquota.Subtract(newQuota.Status.Used, updatedQuota.Status.Total.Used)
+
+	// update aggregate usage
+	updatedQuota.Status.Total.Used = newQuota.Status.Used
+
+	// update per namespace totals
+	oldNamespaceTotals, _ := getResourceQuotasStatusByNamespace(updatedQuota.Status.Namespaces, newQuota.Namespace)
+	namespaceTotalCopy := oldNamespaceTotals.DeepCopy()
+	newNamespaceTotals := *namespaceTotalCopy
+	newNamespaceTotals.Used = utilquota.Add(oldNamespaceTotals.Used, usageDiff)
+	insertResourceQuotasStatus(&updatedQuota.Status.Namespaces, quotav1alpha2.ResourceQuotaStatusByNamespace{
+		Namespace:           newQuota.Namespace,
+		ResourceQuotaStatus: newNamespaceTotals,
+	})
+
+	klog.V(6).Infof("update resource quota: %+v", updatedQuota)
+	err = a.client.Status().Update(ctx, updatedQuota, &client.UpdateOptions{})
+	if err != nil {
+		klog.Errorf("failed to update resource quota: %v", err)
+		return err
+	}
+
+	a.updatedResourceQuotas.Add(resourceQuota.Name, updatedQuota)
+	return nil
+}
+
+var etcdVersioner = etcd.APIObjectVersioner{}
+
+// checkCache compares the passed quota against the value in the look-aside cache and returns the newer
+// if the cache is out of date, it deletes the stale entry.  This only works because of etcd resourceVersions
+// being monotonically increasing integers
+func (a *accessor) checkCache(resourceQuota *quotav1alpha2.ResourceQuota) *quotav1alpha2.ResourceQuota {
+	uncastCachedQuota, ok := a.updatedResourceQuotas.Get(resourceQuota.Name)
+	if !ok {
+		return resourceQuota
+	}
+	cachedQuota := uncastCachedQuota.(*quotav1alpha2.ResourceQuota)
+
+	if etcdVersioner.CompareResourceVersion(resourceQuota, cachedQuota) >= 0 {
+		a.updatedResourceQuotas.Remove(resourceQuota.Name)
+		return resourceQuota
+	}
+	return cachedQuota
+}
+
+func (a *accessor) GetQuotas(namespaceName string) ([]corev1.ResourceQuota, error) {
+	resourceQuotaNames, err := a.waitForReadyResourceQuotaNames(namespaceName)
+	if err != nil {
+		klog.Errorf("failed to fetch resource quota names: %v, %v", namespaceName, err)
+		return nil, err
+	}
+	var result []corev1.ResourceQuota
+	for _, resourceQuotaName := range resourceQuotaNames {
+		resourceQuota := &quotav1alpha2.ResourceQuota{}
+		err = a.client.Get(context.TODO(), types.NamespacedName{Name: resourceQuotaName}, resourceQuota)
+		if err != nil {
+			klog.Errorf("failed to fetch resource quota %s: %v", resourceQuotaName, err)
+			return result, err
+		}
+		resourceQuota = a.checkCache(resourceQuota)
+
+		// now convert to a ResourceQuota
+		convertedQuota := corev1.ResourceQuota{}
+		convertedQuota.APIVersion = quotav1alpha2.SchemeGroupVersion.String()
+		convertedQuota.ObjectMeta = resourceQuota.ObjectMeta
+		convertedQuota.Namespace = namespaceName
+		convertedQuota.Spec = resourceQuota.Spec.Quota
+		convertedQuota.Status = resourceQuota.Status.Total
+		result = append(result, convertedQuota)
+	}
+
+	// avoid conflicts with namespaced resource quota
+	namespacedResourceQuotas, err := a.waitForReadyNamespacedResourceQuotas(namespaceName)
+	if err != nil {
+		klog.Errorf("failed to fetch namespaced resource quotas: %v, %v", namespaceName, err)
+		return nil, err
+	}
+	for _, resourceQuota := range namespacedResourceQuotas {
+		resourceQuota.APIVersion = corev1.SchemeGroupVersion.String()
+		result = append(result, resourceQuota)
+	}
+	return result, nil
+}
+
+func (a *accessor) waitForReadyResourceQuotaNames(namespaceName string) ([]string, error) {
+	ctx := context.TODO()
+	var resourceQuotaNames []string
+	var err error
+	// wait for a valid mapping cache.  The overall response can be delayed for up to 10 seconds.
+	err = utilwait.PollImmediate(100*time.Millisecond, 8*time.Second, func() (done bool, err error) {
+		resourceQuotaNames, err = resourceQuotaNamesFor(ctx, a.client, namespaceName)
+		// if we can't find the namespace yet, just wait for the cache to update.  Requests to non-existent namespaces
+		// may hang, but those people are doing something wrong and namespace lifecycle should reject them.
+		if apierrors.IsNotFound(err) {
+			return false, nil
+		}
+		if err != nil {
+			return false, err
+		}
+		return true, nil
+	})
+	return resourceQuotaNames, err
+}
+
+func (a *accessor) waitForReadyNamespacedResourceQuotas(namespaceName string) ([]corev1.ResourceQuota, error) {
+	ctx := context.TODO()
+	var resourceQuotas []corev1.ResourceQuota
+	var err error
+	// wait for a valid mapping cache.  The overall response can be delayed for up to 10 seconds.
+	err = utilwait.PollImmediate(100*time.Millisecond, 8*time.Second, func() (done bool, err error) {
+		resourceQuotaList := &corev1.ResourceQuotaList{}
+		err = a.client.List(ctx, resourceQuotaList, &client.ListOptions{Namespace: namespaceName})
+		if err != nil {
+			return false, err
+		}
+		resourceQuotas = resourceQuotaList.Items
+		return true, nil
+	})
+	return resourceQuotas, err
+}

pkg/controller/quota/lockfactory.go

@@ -0,0 +1,59 @@
+/*
+
+ Copyright 2021 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package quota
+
+import (
+	"sync"
+)
+
+// Following code copied from github.com/openshift/apiserver-library-go/pkg/admission/quota/clusterresourcequota
+type LockFactory interface {
+	GetLock(string) sync.Locker
+}
+
+type DefaultLockFactory struct {
+	lock sync.RWMutex
+
+	locks map[string]sync.Locker
+}
+
+func NewDefaultLockFactory() *DefaultLockFactory {
+	return &DefaultLockFactory{locks: map[string]sync.Locker{}}
+}
+
+func (f *DefaultLockFactory) GetLock(key string) sync.Locker {
+	lock, exists := f.getExistingLock(key)
+	if exists {
+		return lock
+	}
+
+	f.lock.Lock()
+	defer f.lock.Unlock()
+	lock = &sync.Mutex{}
+	f.locks[key] = lock
+	return lock
+}
+
+func (f *DefaultLockFactory) getExistingLock(key string) (sync.Locker, bool) {
+	f.lock.RLock()
+	defer f.lock.RUnlock()
+
+	lock, exists := f.locks[key]
+	return lock, exists
+}

pkg/controller/quota/resourcequota_controller.go

@@ -0,0 +1,299 @@
+/*
+
+ Copyright 2021 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package quota
+
+import (
+	"context"
+	"github.com/go-logr/logr"
+	"k8s.io/apimachinery/pkg/api/equality"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/clock"
+	"k8s.io/client-go/tools/record"
+	"k8s.io/klog"
+	evaluatorcore "kubesphere.io/kubesphere/kube/pkg/quota/v1/evaluator/core"
+	"kubesphere.io/kubesphere/kube/pkg/quota/v1/generic"
+	"kubesphere.io/kubesphere/kube/pkg/quota/v1/install"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
+	"kubesphere.io/kubesphere/pkg/constants"
+	"kubesphere.io/kubesphere/pkg/utils/sliceutil"
+	"math"
+	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
+	"sigs.k8s.io/controller-runtime/pkg/event"
+	"sigs.k8s.io/controller-runtime/pkg/handler"
+	"sigs.k8s.io/controller-runtime/pkg/predicate"
+	"sigs.k8s.io/controller-runtime/pkg/reconcile"
+	"sigs.k8s.io/controller-runtime/pkg/source"
+	"time"
+
+	k8sinformers "k8s.io/client-go/informers"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	corev1 "k8s.io/api/core/v1"
+
+	quotav1 "kubesphere.io/kubesphere/kube/pkg/quota/v1"
+
+	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/controller"
+)
+
+const (
+	ControllerName                 = "resourcequota-controller"
+	DefaultResyncPeriod            = 5 * time.Minute
+	DefaultMaxConcurrentReconciles = 8
+)
+
+// Reconciler reconciles a Workspace object
+type Reconciler struct {
+	client.Client
+	logger                  logr.Logger
+	recorder                record.EventRecorder
+	maxConcurrentReconciles int
+	// Knows how to calculate usage
+	registry quotav1.Registry
+	// Controls full recalculation of quota usage
+	resyncPeriod time.Duration
+	scheme       *runtime.Scheme
+}
+
+func (r *Reconciler) SetupWithManager(mgr ctrl.Manager, maxConcurrentReconciles int, resyncPeriod time.Duration, informerFactory k8sinformers.SharedInformerFactory) error {
+	r.logger = ctrl.Log.WithName("controllers").WithName(ControllerName)
+	r.recorder = mgr.GetEventRecorderFor(ControllerName)
+	r.scheme = mgr.GetScheme()
+	r.registry = generic.NewRegistry(install.NewQuotaConfigurationForControllers(generic.ListerFuncForResourceFunc(informerFactory.ForResource)).Evaluators())
+	if r.Client == nil {
+		r.Client = mgr.GetClient()
+	}
+	if maxConcurrentReconciles > 0 {
+		r.maxConcurrentReconciles = maxConcurrentReconciles
+	} else {
+		r.maxConcurrentReconciles = DefaultMaxConcurrentReconciles
+	}
+	r.resyncPeriod = time.Duration(math.Max(float64(resyncPeriod), float64(DefaultResyncPeriod)))
+	c, err := ctrl.NewControllerManagedBy(mgr).
+		Named(ControllerName).
+		WithOptions(controller.Options{
+			MaxConcurrentReconciles: r.maxConcurrentReconciles,
+		}).
+		For(&quotav1alpha2.ResourceQuota{}).
+		WithEventFilter(predicate.GenerationChangedPredicate{
+			Funcs: predicate.Funcs{
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					oldQuota := e.ObjectOld.(*quotav1alpha2.ResourceQuota)
+					newQuota := e.ObjectNew.(*quotav1alpha2.ResourceQuota)
+					return !equality.Semantic.DeepEqual(oldQuota.Spec, newQuota.Spec)
+				},
+			},
+		}).
+		Build(r)
+	if err != nil {
+		return err
+	}
+
+	resources := []runtime.Object{
+		&corev1.Pod{},
+		&corev1.Service{},
+		&corev1.PersistentVolumeClaim{},
+	}
+	realClock := clock.RealClock{}
+	for _, resource := range resources {
+		err := c.Watch(
+			&source.Kind{Type: resource},
+			&handler.EnqueueRequestsFromMapFunc{ToRequests: handler.ToRequestsFunc(r.mapper)},
+			predicate.Funcs{
+				GenericFunc: func(e event.GenericEvent) bool {
+					return false
+				},
+				CreateFunc: func(e event.CreateEvent) bool {
+					return false
+				},
+				UpdateFunc: func(e event.UpdateEvent) bool {
+					notifyChange := false
+					// we only want to queue the updates we care about though as too much noise will overwhelm queue.
+					switch e.MetaOld.(type) {
+					case *corev1.Pod:
+						oldPod := e.ObjectOld.(*corev1.Pod)
+						newPod := e.ObjectNew.(*corev1.Pod)
+						notifyChange = evaluatorcore.QuotaV1Pod(oldPod, realClock) && !evaluatorcore.QuotaV1Pod(newPod, realClock)
+					case *corev1.Service:
+						oldService := e.ObjectOld.(*corev1.Service)
+						newService := e.ObjectNew.(*corev1.Service)
+						notifyChange = evaluatorcore.GetQuotaServiceType(oldService) != evaluatorcore.GetQuotaServiceType(newService)
+					case *corev1.PersistentVolumeClaim:
+						notifyChange = true
+					}
+					return notifyChange
+				},
+				DeleteFunc: func(e event.DeleteEvent) bool {
+					return true
+				},
+			})
+		if err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (r *Reconciler) mapper(h handler.MapObject) []reconcile.Request {
+	// check if the quota controller can evaluate this kind, if not, ignore it altogether...
+	var result []reconcile.Request
+	evaluators := r.registry.List()
+	ctx := context.TODO()
+	resourceQuotaNames, err := resourceQuotaNamesFor(ctx, r.Client, h.Meta.GetNamespace())
+	if err != nil {
+		klog.Errorf("failed to get resource quota names for: %v %T %v, err: %v", h.Meta.GetNamespace(), h.Object, h.Meta.GetName(), err)
+		return result
+	}
+	// only queue those quotas that are tracking a resource associated with this kind.
+	for _, resourceQuotaName := range resourceQuotaNames {
+		resourceQuota := &quotav1alpha2.ResourceQuota{}
+		if err := r.Get(ctx, types.NamespacedName{Name: resourceQuotaName}, resourceQuota); err != nil {
+			klog.Errorf("failed to get resource quota: %v, err: %v", resourceQuotaName, err)
+			return result
+		}
+		resourceQuotaResources := quotav1.ResourceNames(resourceQuota.Status.Total.Hard)
+		for _, evaluator := range evaluators {
+			matchedResources := evaluator.MatchingResources(resourceQuotaResources)
+			if len(matchedResources) > 0 {
+				result = append(result, reconcile.Request{NamespacedName: types.NamespacedName{Name: resourceQuotaName}})
+				break
+			}
+		}
+	}
+	klog.V(6).Infof("resource quota reconcile after resource change: %v %T %v, %+v", h.Meta.GetNamespace(), h.Object, h.Meta.GetName(), result)
+	return result
+}
+
+func (r *Reconciler) Reconcile(req ctrl.Request) (ctrl.Result, error) {
+	logger := r.logger.WithValues("resourcequota", req.NamespacedName)
+	rootCtx := context.TODO()
+	resourceQuota := &quotav1alpha2.ResourceQuota{}
+	if err := r.Get(rootCtx, req.NamespacedName, resourceQuota); err != nil {
+		return ctrl.Result{}, client.IgnoreNotFound(err)
+	}
+
+	if err := r.bindWorkspace(resourceQuota); err != nil {
+		logger.Error(err, "failed to set owner reference")
+		return ctrl.Result{}, err
+	}
+
+	if err := r.syncQuotaForNamespaces(resourceQuota); err != nil {
+		logger.Error(err, "failed to sync quota")
+		return ctrl.Result{}, err
+	}
+
+	r.recorder.Event(resourceQuota, corev1.EventTypeNormal, "Synced", "Synced successfully")
+	return ctrl.Result{RequeueAfter: r.resyncPeriod}, nil
+}
+
+func (r *Reconciler) bindWorkspace(resourceQuota *quotav1alpha2.ResourceQuota) error {
+	workspaceName := resourceQuota.Labels[constants.WorkspaceLabelKey]
+	if workspaceName == "" {
+		return nil
+	}
+
+	workspace := &tenantv1alpha1.Workspace{}
+	err := r.Get(context.TODO(), types.NamespacedName{Name: workspaceName}, workspace)
+	if err != nil {
+		return client.IgnoreNotFound(err)
+	}
+
+	if !metav1.IsControlledBy(resourceQuota, workspace) {
+		resourceQuota.OwnerReferences = nil
+		if err := controllerutil.SetControllerReference(workspace, resourceQuota, r.scheme); err != nil {
+			return err
+		}
+		err = r.Update(context.TODO(), resourceQuota)
+		if err != nil {
+			klog.Error(err)
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (r *Reconciler) syncQuotaForNamespaces(originalQuota *quotav1alpha2.ResourceQuota) error {
+	quota := originalQuota.DeepCopy()
+	ctx := context.TODO()
+	// get the list of namespaces that match this cluster quota
+	matchingNamespaceList := corev1.NamespaceList{}
+	if err := r.List(ctx, &matchingNamespaceList, &client.ListOptions{LabelSelector: labels.SelectorFromSet(quota.Spec.LabelSelector)}); err != nil {
+		return err
+	}
+
+	matchingNamespaceNames := make([]string, 0)
+	for _, namespace := range matchingNamespaceList.Items {
+		matchingNamespaceNames = append(matchingNamespaceNames, namespace.Name)
+	}
+
+	for _, namespace := range matchingNamespaceList.Items {
+		namespaceName := namespace.Name
+		namespaceTotals, _ := getResourceQuotasStatusByNamespace(quota.Status.Namespaces, namespaceName)
+
+		actualUsage, err := quotaUsageCalculationFunc(namespaceName, quota.Spec.Quota.Scopes, quota.Spec.Quota.Hard, r.registry, quota.Spec.Quota.ScopeSelector)
+		if err != nil {
+			return err
+		}
+		recalculatedStatus := corev1.ResourceQuotaStatus{
+			Used: actualUsage,
+			Hard: quota.Spec.Quota.Hard,
+		}
+
+		// subtract old usage, add new usage
+		quota.Status.Total.Used = quotav1.Subtract(quota.Status.Total.Used, namespaceTotals.Used)
+		quota.Status.Total.Used = quotav1.Add(quota.Status.Total.Used, recalculatedStatus.Used)
+		insertResourceQuotasStatus(&quota.Status.Namespaces, quotav1alpha2.ResourceQuotaStatusByNamespace{
+			Namespace:           namespaceName,
+			ResourceQuotaStatus: recalculatedStatus,
+		})
+	}
+
+	// Remove any namespaces from quota.status that no longer match.
+	statusCopy := quota.Status.Namespaces.DeepCopy()
+	for _, namespaceTotals := range statusCopy {
+		namespaceName := namespaceTotals.Namespace
+		if !sliceutil.HasString(matchingNamespaceNames, namespaceName) {
+			quota.Status.Total.Used = quotav1.Subtract(quota.Status.Total.Used, namespaceTotals.Used)
+			removeResourceQuotasStatusByNamespace(&quota.Status.Namespaces, namespaceName)
+		}
+	}
+
+	quota.Status.Total.Hard = quota.Spec.Quota.Hard
+
+	// if there's no change, no update, return early.  NewAggregate returns nil on empty input
+	if equality.Semantic.DeepEqual(quota, originalQuota) {
+		return nil
+	}
+
+	klog.V(6).Infof("update resource quota: %+v", quota)
+	if err := r.Status().Update(ctx, quota, &client.UpdateOptions{}); err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// quotaUsageCalculationFunc is a function to calculate quota usage.  It is only configurable for easy unit testing
+// NEVER CHANGE THIS OUTSIDE A TEST
+var quotaUsageCalculationFunc = quotav1.CalculateUsage

pkg/controller/quota/resourcequota_webhook.go

@@ -0,0 +1,191 @@
+/*
+
+ Copyright 2021 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package quota
+
+import (
+	"context"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	utilwait "k8s.io/apimachinery/pkg/util/wait"
+	admissionapi "k8s.io/apiserver/pkg/admission"
+	"k8s.io/apiserver/pkg/authentication/user"
+	"k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/klog"
+	"kubesphere.io/kubesphere/kube/pkg/quota/v1"
+	"kubesphere.io/kubesphere/kube/pkg/quota/v1/generic"
+	"kubesphere.io/kubesphere/kube/pkg/quota/v1/install"
+	"kubesphere.io/kubesphere/kube/plugin/pkg/admission/resourcequota"
+	resourcequotaapi "kubesphere.io/kubesphere/kube/plugin/pkg/admission/resourcequota/apis/resourcequota"
+	"net/http"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+	"sigs.k8s.io/controller-runtime/pkg/webhook"
+	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
+	"sort"
+	"sync"
+)
+
+const (
+	numEvaluatorThreads = 10
+)
+
+type ResourceQuotaAdmission struct {
+	client client.Client
+
+	decoder *webhook.AdmissionDecoder
+
+	lockFactory LockFactory
+
+	// these are used to create the evaluator
+	registry quota.Registry
+
+	init      sync.Once
+	evaluator resourcequota.Evaluator
+}
+
+func NewResourceQuotaAdmission(client client.Client, scheme *runtime.Scheme) (webhook.AdmissionHandler, error) {
+	decoder, err := admission.NewDecoder(scheme)
+	if err != nil {
+		return nil, err
+	}
+	return &ResourceQuotaAdmission{
+		client:      client,
+		lockFactory: NewDefaultLockFactory(),
+		decoder:     decoder,
+		registry:    generic.NewRegistry(install.NewQuotaConfigurationForAdmission().Evaluators()),
+	}, nil
+}
+
+func (r *ResourceQuotaAdmission) Handle(ctx context.Context, req webhook.AdmissionRequest) webhook.AdmissionResponse {
+	// ignore all operations that correspond to sub-resource actions
+	if len(req.RequestSubResource) != 0 {
+		return webhook.Allowed("")
+	}
+	// ignore cluster level resources
+	if len(req.Namespace) == 0 {
+		return webhook.Allowed("")
+	}
+
+	r.init.Do(func() {
+		resourceQuotaAccessor := newQuotaAccessor(r.client)
+		r.evaluator = resourcequota.NewQuotaEvaluator(resourceQuotaAccessor, install.DefaultIgnoredResources(), r.registry, r.lockAquisition, &resourcequotaapi.Configuration{}, numEvaluatorThreads, utilwait.NeverStop)
+	})
+
+	attributesRecord, err := convertToAdmissionAttributes(req)
+	if err != nil {
+		klog.Error(err)
+		return webhook.Errored(http.StatusBadRequest, err)
+	}
+
+	if err := r.evaluator.Evaluate(attributesRecord); err != nil {
+		if errors.IsForbidden(err) {
+			klog.Info(err)
+			return webhook.Denied(err.Error())
+		}
+		klog.Error(err)
+		return webhook.Errored(http.StatusInternalServerError, err)
+	}
+
+	return webhook.Allowed("")
+}
+
+type ByName []corev1.ResourceQuota
+
+func (v ByName) Len() int           { return len(v) }
+func (v ByName) Swap(i, j int)      { v[i], v[j] = v[j], v[i] }
+func (v ByName) Less(i, j int) bool { return v[i].Name < v[j].Name }
+
+func (r *ResourceQuotaAdmission) lockAquisition(quotas []corev1.ResourceQuota) func() {
+	var locks []sync.Locker
+
+	// acquire the locks in alphabetical order because I'm too lazy to think of something clever
+	sort.Sort(ByName(quotas))
+	for _, quota := range quotas {
+		lock := r.lockFactory.GetLock(string(quota.UID))
+		lock.Lock()
+		locks = append(locks, lock)
+	}
+
+	return func() {
+		for i := len(locks) - 1; i >= 0; i-- {
+			locks[i].Unlock()
+		}
+	}
+}
+
+func convertToAdmissionAttributes(req admission.Request) (admissionapi.Attributes, error) {
+	var err error
+	var object runtime.Object
+	if len(req.Object.Raw) > 0 {
+		object, _, err = scheme.Codecs.UniversalDeserializer().Decode(req.Object.Raw, nil, nil)
+		if err != nil {
+			return nil, err
+		}
+	}
+
+	var oldObject runtime.Object
+	if len(req.OldObject.Raw) > 0 {
+		oldObject, _, err = scheme.Codecs.UniversalDeserializer().Decode(req.OldObject.Raw, nil, nil)
+		if err != nil {
+			klog.Error(err)
+			return nil, err
+		}
+	}
+
+	var operationOptions runtime.Object
+	if len(req.Options.Raw) > 0 {
+		operationOptions, _, err = scheme.Codecs.UniversalDeserializer().Decode(req.Options.Raw, nil, nil)
+		if err != nil {
+			klog.Error(err)
+			return nil, err
+		}
+	}
+
+	extras := map[string][]string{}
+	for k, v := range req.UserInfo.Extra {
+		extras[k] = v
+	}
+
+	attributesRecord := admissionapi.NewAttributesRecord(object,
+		oldObject,
+		schema.GroupVersionKind{
+			Group:   req.RequestKind.Group,
+			Version: req.RequestKind.Version,
+			Kind:    req.RequestKind.Kind,
+		},
+		req.Namespace,
+		req.Name,
+		schema.GroupVersionResource{
+			Group:    req.RequestResource.Group,
+			Version:  req.RequestResource.Version,
+			Resource: req.RequestResource.Resource,
+		},
+		req.SubResource,
+		admissionapi.Operation(req.Operation),
+		operationOptions,
+		*req.DryRun,
+		&user.DefaultInfo{
+			Name:   req.UserInfo.Username,
+			UID:    req.UserInfo.UID,
+			Groups: req.UserInfo.Groups,
+			Extra:  extras,
+		})
+	return attributesRecord, nil
+}

pkg/controller/quota/util.go

@@ -0,0 +1,92 @@
+/*
+
+ Copyright 2021 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package quota
+
+import (
+	"context"
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	"k8s.io/apimachinery/pkg/types"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+)
+
+// Following code copied from github.com/openshift/library-go/pkg/quota/quotautil
+func getResourceQuotasStatusByNamespace(namespaceStatuses quotav1alpha2.ResourceQuotasStatusByNamespace, namespace string) (corev1.ResourceQuotaStatus, bool) {
+	for i := range namespaceStatuses {
+		curr := namespaceStatuses[i]
+		if curr.Namespace == namespace {
+			return curr.ResourceQuotaStatus, true
+		}
+	}
+	return corev1.ResourceQuotaStatus{}, false
+}
+
+func removeResourceQuotasStatusByNamespace(namespaceStatuses *quotav1alpha2.ResourceQuotasStatusByNamespace, namespace string) {
+	newNamespaceStatuses := quotav1alpha2.ResourceQuotasStatusByNamespace{}
+	for i := range *namespaceStatuses {
+		curr := (*namespaceStatuses)[i]
+		if curr.Namespace == namespace {
+			continue
+		}
+		newNamespaceStatuses = append(newNamespaceStatuses, curr)
+	}
+	*namespaceStatuses = newNamespaceStatuses
+}
+
+func insertResourceQuotasStatus(namespaceStatuses *quotav1alpha2.ResourceQuotasStatusByNamespace, newStatus quotav1alpha2.ResourceQuotaStatusByNamespace) {
+	newNamespaceStatuses := quotav1alpha2.ResourceQuotasStatusByNamespace{}
+	found := false
+	for i := range *namespaceStatuses {
+		curr := (*namespaceStatuses)[i]
+		if curr.Namespace == newStatus.Namespace {
+			// do this so that we don't change serialization order
+			newNamespaceStatuses = append(newNamespaceStatuses, newStatus)
+			found = true
+			continue
+		}
+		newNamespaceStatuses = append(newNamespaceStatuses, curr)
+	}
+	if !found {
+		newNamespaceStatuses = append(newNamespaceStatuses, newStatus)
+	}
+	*namespaceStatuses = newNamespaceStatuses
+}
+
+func resourceQuotaNamesFor(ctx context.Context, client client.Client, namespaceName string) ([]string, error) {
+	namespace := &corev1.Namespace{}
+	var resourceQuotaNames []string
+	if err := client.Get(ctx, types.NamespacedName{Name: namespaceName}, namespace); err != nil {
+		return resourceQuotaNames, err
+	}
+	if len(namespace.Labels) == 0 {
+		return resourceQuotaNames, nil
+	}
+	resourceQuotaList := &quotav1alpha2.ResourceQuotaList{}
+	if err := client.List(ctx, resourceQuotaList); err != nil {
+		return resourceQuotaNames, err
+	}
+	for _, resourceQuota := range resourceQuotaList.Items {
+		if len(resourceQuota.Spec.LabelSelector) > 0 &&
+			labels.SelectorFromSet(resourceQuota.Spec.LabelSelector).Matches(labels.Set(namespace.Labels)) {
+			resourceQuotaNames = append(resourceQuotaNames, resourceQuota.Name)
+		}
+	}
+	return resourceQuotaNames, nil
+}

pkg/kapis/tenant/v1alpha2/handler.go

@@ -29,6 +29,7 @@ import (
 	auditingv1alpha1 "kubesphere.io/kubesphere/pkg/api/auditing/v1alpha1"
 	eventsv1alpha1 "kubesphere.io/kubesphere/pkg/api/events/v1alpha1"
 	loggingv1alpha2 "kubesphere.io/kubesphere/pkg/api/logging/v1alpha2"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
 	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
 	"kubesphere.io/kubesphere/pkg/apiserver/query"
@@ -546,3 +547,78 @@ func (h *tenantHandler) ListClusters(r *restful.Request, response *restful.Respo
 
 	response.WriteEntity(result)
 }
+
+func (h *tenantHandler) CreateWorkspaceResourceQuota(r *restful.Request, response *restful.Response) {
+	workspaceName := r.PathParameter("workspace")
+	resourceQuota := &quotav1alpha2.ResourceQuota{}
+	err := r.ReadEntity(resourceQuota)
+	if err != nil {
+		api.HandleBadRequest(response, r, err)
+		return
+	}
+	result, err := h.tenant.CreateWorkspaceResourceQuota(workspaceName, resourceQuota)
+	if err != nil {
+		api.HandleInternalError(response, r, err)
+		return
+	}
+	response.WriteEntity(result)
+}
+
+func (h *tenantHandler) DeleteWorkspaceResourceQuota(r *restful.Request, response *restful.Response) {
+	workspace := r.PathParameter("workspace")
+	resourceQuota := r.PathParameter("resourcequota")
+
+	if err := h.tenant.DeleteWorkspaceResourceQuota(workspace, resourceQuota); err != nil {
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, r, err)
+			return
+		}
+		api.HandleInternalError(response, r, err)
+		return
+	}
+
+	response.WriteEntity(servererr.None)
+}
+
+func (h *tenantHandler) UpdateWorkspaceResourceQuota(r *restful.Request, response *restful.Response) {
+	workspaceName := r.PathParameter("workspace")
+	resourceQuotaName := r.PathParameter("resourcequota")
+	resourceQuota := &quotav1alpha2.ResourceQuota{}
+	err := r.ReadEntity(resourceQuota)
+	if err != nil {
+		api.HandleBadRequest(response, r, err)
+		return
+	}
+
+	if resourceQuotaName != resourceQuota.Name {
+		err := fmt.Errorf("the name of the object (%s) does not match the name on the URL (%s)", resourceQuota.Name, resourceQuotaName)
+		klog.Errorf("%+v", err)
+		api.HandleBadRequest(response, r, err)
+		return
+	}
+
+	result, err := h.tenant.UpdateWorkspaceResourceQuota(workspaceName, resourceQuota)
+	if err != nil {
+		api.HandleInternalError(response, r, err)
+		return
+	}
+
+	response.WriteEntity(result)
+}
+
+func (h *tenantHandler) DescribeWorkspaceResourceQuota(r *restful.Request, response *restful.Response) {
+	workspaceName := r.PathParameter("workspace")
+	resourceQuotaName := r.PathParameter("resourcequota")
+
+	resourceQuota, err := h.tenant.DescribeWorkspaceResourceQuota(workspaceName, resourceQuotaName)
+	if err != nil {
+		if errors.IsNotFound(err) {
+			api.HandleNotFound(response, r, err)
+			return
+		}
+		api.HandleInternalError(response, r, err)
+		return
+	}
+
+	response.WriteEntity(resourceQuota)
+}

pkg/kapis/tenant/v1alpha2/register.go

@@ -26,6 +26,7 @@ import (
 	auditingv1alpha1 "kubesphere.io/kubesphere/pkg/api/auditing/v1alpha1"
 	eventsv1alpha1 "kubesphere.io/kubesphere/pkg/api/events/v1alpha1"
 	loggingv1alpha2 "kubesphere.io/kubesphere/pkg/api/logging/v1alpha2"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
 	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
 	"kubesphere.io/kubesphere/pkg/apiserver/authorization/authorizer"
 	"kubesphere.io/kubesphere/pkg/apiserver/runtime"
@@ -288,6 +289,38 @@ func AddToContainer(c *restful.Container, factory informers.InformerFactory, k8s
 		Writes(auditingv1alpha1.APIResponse{}).
 		Returns(http.StatusOK, api.StatusOK, auditingv1alpha1.APIResponse{}))
 
+	ws.Route(ws.POST("/workspaces/{workspace}/resourcequotas").
+		To(handler.CreateWorkspaceResourceQuota).
+		Reads(quotav1alpha2.ResourceQuota{}).
+		Returns(http.StatusOK, api.StatusOK, quotav1alpha2.ResourceQuota{}).
+		Doc("Create resource quota.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.WorkspaceTag}))
+
+	ws.Route(ws.DELETE("/workspaces/{workspace}/resourcequotas/{resourcequota}").
+		To(handler.DeleteWorkspaceResourceQuota).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("resourcequota", "resource quota name")).
+		Returns(http.StatusOK, api.StatusOK, errors.None).
+		Doc("Delete resource quota.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.WorkspaceTag}))
+
+	ws.Route(ws.PUT("/workspaces/{workspace}/resourcequotas/{resourcequota}").
+		To(handler.UpdateWorkspaceResourceQuota).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("resourcequota", "resource quota name")).
+		Reads(quotav1alpha2.ResourceQuota{}).
+		Returns(http.StatusOK, api.StatusOK, quotav1alpha2.ResourceQuota{}).
+		Doc("Update resource quota.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.WorkspaceTag}))
+
+	ws.Route(ws.GET("/workspaces/{workspace}/resourcequotas/{resourcequota}").
+		To(handler.DescribeWorkspaceResourceQuota).
+		Param(ws.PathParameter("workspace", "workspace name")).
+		Param(ws.PathParameter("resourcequota", "resource quota name")).
+		Returns(http.StatusOK, api.StatusOK, quotav1alpha2.ResourceQuota{}).
+		Doc("Describe resource quota.").
+		Metadata(restfulspec.KeyOpenAPITags, []string{constants.WorkspaceTag}))
+
 	c.Add(ws)
 	return nil
 }

pkg/models/tenant/resourcequota.go

@@ -0,0 +1,75 @@
+/*
+
+ Copyright 2021 The KubeSphere Authors.
+
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+
+     http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+
+*/
+
+package tenant
+
+import (
+	"context"
+	"k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
+	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
+)
+
+func (t *tenantOperator) CreateWorkspaceResourceQuota(workspace string, quota *quotav1alpha2.ResourceQuota) (*quotav1alpha2.ResourceQuota, error) {
+	if quota.Labels == nil {
+		quota.Labels = make(map[string]string)
+	}
+	quota.Labels[tenantv1alpha1.WorkspaceLabel] = workspace
+	quota.Spec.LabelSelector = labels.Set{tenantv1alpha1.WorkspaceLabel: workspace}
+	return t.ksclient.QuotaV1alpha2().ResourceQuotas().Create(context.TODO(), quota, metav1.CreateOptions{})
+}
+
+func (t *tenantOperator) UpdateWorkspaceResourceQuota(workspace string, quota *quotav1alpha2.ResourceQuota) (*quotav1alpha2.ResourceQuota, error) {
+	resourceQuota, err := t.ksclient.QuotaV1alpha2().ResourceQuotas().Get(context.TODO(), quota.Name, metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+	if resourceQuota.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
+		return nil, errors.NewNotFound(quotav1alpha2.Resource(quotav1alpha2.ResourcesSingularCluster), resourceQuota.Name)
+	}
+	if quota.Labels == nil {
+		quota.Labels = make(map[string]string)
+	}
+	quota.Labels[tenantv1alpha1.WorkspaceLabel] = workspace
+	quota.Spec.LabelSelector = labels.Set{tenantv1alpha1.WorkspaceLabel: workspace}
+	return t.ksclient.QuotaV1alpha2().ResourceQuotas().Update(context.TODO(), quota, metav1.UpdateOptions{})
+}
+
+func (t *tenantOperator) DeleteWorkspaceResourceQuota(workspace string, resourceQuotaName string) error {
+	resourceQuota, err := t.ksclient.QuotaV1alpha2().ResourceQuotas().Get(context.TODO(), resourceQuotaName, metav1.GetOptions{})
+	if err != nil {
+		return err
+	}
+	if resourceQuota.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
+		return errors.NewNotFound(quotav1alpha2.Resource(quotav1alpha2.ResourcesSingularCluster), resourceQuotaName)
+	}
+	return t.ksclient.QuotaV1alpha2().ResourceQuotas().Delete(context.TODO(), resourceQuotaName, metav1.DeleteOptions{})
+}
+
+func (t *tenantOperator) DescribeWorkspaceResourceQuota(workspace string, resourceQuotaName string) (*quotav1alpha2.ResourceQuota, error) {
+	resourceQuota, err := t.ksclient.QuotaV1alpha2().ResourceQuotas().Get(context.TODO(), resourceQuotaName, metav1.GetOptions{})
+	if err != nil {
+		return nil, err
+	}
+	if resourceQuota.Labels[tenantv1alpha1.WorkspaceLabel] != workspace {
+		return nil, errors.NewNotFound(quotav1alpha2.Resource(quotav1alpha2.ResourcesSingularCluster), resourceQuotaName)
+	}
+	return resourceQuota, nil
+}

pkg/models/tenant/tenant.go

@@ -38,6 +38,7 @@ import (
 	eventsv1alpha1 "kubesphere.io/kubesphere/pkg/api/events/v1alpha1"
 	loggingv1alpha2 "kubesphere.io/kubesphere/pkg/api/logging/v1alpha2"
 	clusterv1alpha1 "kubesphere.io/kubesphere/pkg/apis/cluster/v1alpha1"
+	quotav1alpha2 "kubesphere.io/kubesphere/pkg/apis/quota/v1alpha2"
 	tenantv1alpha1 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha1"
 	tenantv1alpha2 "kubesphere.io/kubesphere/pkg/apis/tenant/v1alpha2"
 	typesv1beta1 "kubesphere.io/kubesphere/pkg/apis/types/v1beta1"
@@ -79,6 +80,10 @@ type Interface interface {
 	PatchNamespace(workspace string, namespace *corev1.Namespace) (*corev1.Namespace, error)
 	PatchWorkspace(workspace string, data json.RawMessage) (*tenantv1alpha2.WorkspaceTemplate, error)
 	ListClusters(info user.Info) (*api.ListResult, error)
+	CreateWorkspaceResourceQuota(workspace string, resourceQuota *quotav1alpha2.ResourceQuota) (*quotav1alpha2.ResourceQuota, error)
+	DeleteWorkspaceResourceQuota(workspace string, resourceQuotaName string) error
+	UpdateWorkspaceResourceQuota(workspace string, resourceQuota *quotav1alpha2.ResourceQuota) (*quotav1alpha2.ResourceQuota, error)
+	DescribeWorkspaceResourceQuota(workspace string, resourceQuotaName string) (*quotav1alpha2.ResourceQuota, error)
 }
 
 type tenantOperator struct {