Just like LimitRange, if you're using the ResourceQuota object to administer different levels of QoS, this plugin must be enabled. The ResourceQuota should be always be put at the end of the admission control plugin list. As we mentioned in the ResourceQuota section, if the used quota is less than the hard quota, resource quota usage will be updated to ensure that clusters have sufficient resources to accept requests. Putting it into the end of ServiceAccount admission controller list could prevent the request from increasing quota usage prematurely if it eventually gets rejected by the following controllers.