fix(webhook): enforce ResourceQuota using Status.Hard instead of Spec…

[saddamr3e]

While reviewing the quota validation logic, I noticed that validateResourceQuota checks whether a resource exists in Status.Hard but performs the final comparison against Spec.Hard.

This change makes the validation consistent by using Status.Hard for both the lookup and the comparison. A regression test has also been added to cover the case where Spec.Hard and Status.Hard contain different values.

Proposed changes:

• Update validateResourceQuota to compare resource usage against resourceQuota.Status.Hard.
• Add a regression test (TestValidateResourceQuota_SpecHardDivergence) covering divergent Spec.Hard and Status.Hard values.

Change Category

Bug fix (non-breaking change)
This change updates the resource quota validation logic to consistently use Status.Hard when checking resource limits and adds a regression test to verify the behavior when Spec.Hard and Status.Hard differ.

Rationale

The function already uses Status.Hard to determine whether a resource is tracked. Using the same field for the limit comparison keeps the validation logic consistent and avoids mixing two different quota fields during the same validation.

Checklist

[ ] I have conducted a self-review of my own code.
[ ] I have updated documentation accordingly.
[ ] I have added tests that prove my changes are effective.
[ ] Existing unit tests pass locally with my changes.

Additional Notes

The regression test covers the scenario where Spec.Hard and Status.Hard differ. Running the full webhook test suite locally requires the Kubernetes envtest binaries, which are not available in my current environment.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign yuchaoran2011 for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

🎉 Welcome to the Kubeflow Spark Operator! 🎉

Thanks for opening your first PR! We're happy to have you as part of our community 🚀

Here's what happens next:

• If you haven't already, please check out our Contributing Guide for repo-specific guidelines and the Kubeflow Contributor Guide for general community standards.
• Our team will review your PR soon!

Join the community:

• Slack: Join our #kubeflow-spark-on-kubernetes Slack channel.

Feel free to ask questions in the comments if you need any help or clarification!
Thanks again for contributing to Kubeflow! 🙏

[Copilot]

Pull request overview

This PR fixes the webhook’s ResourceQuota enforcement logic to consistently use ResourceQuota.Status.Hard (the controller-reconciled enforced limit) for both resource presence checks and limit comparisons, and adds a regression test for the case where Spec.Hard and Status.Hard diverge.

Changes:

• Update validateResourceQuota to compare against resourceQuota.Status.Hard instead of resourceQuota.Spec.Hard.
• Add a regression unit test covering divergent Spec.Hard vs Status.Hard values to prevent reintroducing the inconsistency.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
internal/webhook/resourcequota.go	Aligns quota comparison logic to use Status.Hard consistently.
internal/webhook/resourcequota_test.go	Adds regression test for Spec.Hard/Status.Hard divergence scenario.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[saddamr3e]

any update?