Reject unbounded cpu and memory pods if quota is restricting it

[derekwaynecarr]

If a quota is enforcing a hard usage limit on cpu or memory in a Namespace, then we reject any pod whose container is requesting unbounded cpu or memory on a Node.

If a user wants to apply a default cpu or memory usage for each container that has unspecified limits, they can create a LimitRange resource that sets a default.

https://github.com/GoogleCloudPlatform/kubernetes/blob/master/examples/limitrange/v1beta3/limit-range.json#L32

[googlebot]

Thanks for your pull request. It looks like this may be your first contribution to a Google open source project, in which case you'll need to sign a Contributor License Agreement (CLA).

📝 Please visit https://cla.developers.google.com/ to sign.

Once you've signed, please reply here (e.g. I signed it!) and we'll verify. Thanks.

---

• If you've already signed a CLA, it's possible we don't have your GitHub username or you're using a different email address. Check your existing CLA data and verify that your email is set on your git commits.
• If you signed the CLA as a corporation, please let us know the company's name.

[bgrant0607]

cc @erictune

[derekwaynecarr]

@vishh - any chance you can get to this today?

[vishh]

Somehow I missed this PR! LGTM.

[erictune]

I think eventual plan is to have 3 resource tiers (set limit -> Tier 1, set request and limit -> Tier 2, set request -> Tier 3).
Either each tier will have its own separate quota, or, there will be separate quotas for "limit" and "request" -- e.g. user eric can create pods with total limits of 10GB ram, and also, he can create pods with total requests of 50GB.

So, I interpret this as "when quota is enabled, nobody has any Tier3 quota". Which seems fine.

[erictune]

IOW, LGTM