investigate(quota): why are default quota policies enabled globally by default, and how should service configurations be organized?

[JoseSzycho]

Question / Problem Statement

During E2E testing for non-quota features (e.g. resource-management/project-deletion-blocked-resources), creating standard Kubernetes objects like a ConfigMap or Secret inside a test project fails with a quota 403 Forbidden error:

configmaps "held-resource" is forbidden: You've reached your quota for this resource type 
(Insufficient quota resources. Contact your account administrator to review quota limits and usage.).

To unblock tests, PRs have had to temporarily disable global quota policies during test runs (e.g. patching project-configmap-claim-policy to disabled: true).

This raises key architectural questions:

1. Why are default ClaimCreationPolicy resources enabled globally across the entire control plane by default?
2. Is disabling claim policies inside non-quota test suites symptomatic of how service configurations (config/services/) are organized?
3. How should default quota policies behave for newly created Organizations and Projects?

Related to:

• test(resourcemanager): disable global configmap quota policy during project deletion blocked resources e2e test #759