### What happened?

We have Resources Quotes for **services.nodeports** with an allowed limit of 5 and for **services.loadbalancers** with an allowed limit of 1.

```
apiVersion: v1
kind: ResourceQuota
metadata:
  name: network-resources
spec:
  hard:
    services.nodeports: "5"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
spec:
  hard:
    services.loadbalancers: "1"
```

We deploy a **NodePort** type service in the amount of 1 with the publication of 4 ports, one **ClusterIP** type service and the use of the services.nodeports 4/5 resource quota.

```
k get Resourcequotas -n test
NAME                AGE   REQUEST                       LIMIT
compute-resources   18m   services.loadbalancers: 0/3   
network-resources   95s   services.nodeports: 4/5       

k get svc -n test
NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                                                     AGE
my-service-cip              ClusterIP   10.36.39.25    <none>        80/TCP                                                      31m
my-service-np   NodePort    10.36.36.151   <none>        80:30626/TCP,8081:25225/TCP,8083:28082/TCP,9000:26419/TCP   2m33s
```

We deploy a service of the **LoadBalancers** type in the amount of 1 with the publication of 1 port and get the use of the resource quota services.loadbalancers: 1/3   
services.nodeports: 5/5.

```
k get resourcequotas -n test
NAME                AGE     REQUEST                       LIMIT
compute-resources   20m     services.loadbalancers: 1/3   
network-resources   3m24s   services.nodeports: 5/5       

❯ k get svc -n test
NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)                                                     AGE
my-service-lb                  LoadBalancer   10.36.32.236   <pending>     80:32268/TCP                                                16s
my-service-cip              ClusterIP      10.36.39.25    <none>        80/TCP                                                      33m
my-service-np   NodePort       10.36.36.151   <none>        80:30626/TCP,8081:25225/TCP,8083:28082/TCP,9000:26419/TCP   4m17s
```

The described behavior has been tested on versions Kubernetes 1.20, 1.27-1.30, and the result is the same for all.

### What did you expect to happen?

In  the documentation https://kubernetes.io/docs/concepts/policy/resource-quotas/#object-count-quota the use of the resource quota for **services.nodeports** is described as **"The total number of Services of type NodePort that can exist in the namespace."**

In fact, each published port is considered for the services.nodeports resource quota, regardless of the specified type of Load Balancer or NodePort service.

### How can we reproduce it (as minimally and precisely as possible)?

Create Resource Quota

```
apiVersion: v1
kind: ResourceQuota
metadata:
  name: network-resources
spec:
  hard:
    services.nodeports: "5"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
spec:
  hard:
    services.loadbalancers: "1"
```

Create service

```
apiVersion: v1
kind: Service
metadata:
  name: my-service-cip
spec:
  selector:
    app.kubernetes.io/name: MyApp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 9376
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: my-service-np
spec:
  externalTrafficPolicy: Local
  ports:
  - name: api
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: probe
    port: 8081
    protocol: TCP
    targetPort: 8081
  - name: prof
    port: 8083
    protocol: TCP
    targetPort: 8083
  - name: metrics
    port: 9000
    protocol: TCP
    targetPort: 9000
  selector:
    app.kubernetes.io/name: my-service-np
  sessionAffinity: None
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  name: my-service-lb
spec:
  externalTrafficPolicy: Local
  ports:
  - name: api
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: probe
    port: 8081
    protocol: TCP
    targetPort: 8081
  - name: prof
    port: 8083
    protocol: TCP
    targetPort: 8083
  - name: metrics
    port: 9000
    protocol: TCP
    targetPort: 9000
  selector:
    app.kubernetes.io/name: my-service-lb
  sessionAffinity: None
  type: LoadBalancer
```

### Anything else we need to know?

_No response_

### Kubernetes version

<details>

The described behavior has been tested on versions Kubernetes 1.20, 1.27-1.30, and the result is the same for all.

</details>


### Cloud provider

<details>
none
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/

$ uname -a
Linux k8s-xc-01.stage.xxx.ru 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linu
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>
conteinerd
</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
CNI calico
</details>

Resource Quotas does not work correctly for services.nodeports
This is a GitHub Issue
repo:kubernetes
owner:kubernetes
Title : Resource Quotas does not work correctly for services.nodeports
Issue date:

--- start body ---
### What happened?

We have Resources Quotes for **services.nodeports** with an allowed limit of 5 and for **services.loadbalancers** with an allowed limit of 1.

```
apiVersion: v1
kind: ResourceQuota
metadata:
  name: network-resources
spec:
  hard:
    services.nodeports: "5"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
spec:
  hard:
    services.loadbalancers: "1"
```

We deploy a **NodePort** type service in the amount of 1 with the publication of 4 ports, one **ClusterIP** type service and the use of the services.nodeports 4/5 resource quota.

```
k get Resourcequotas -n test
NAME                AGE   REQUEST                       LIMIT
compute-resources   18m   services.loadbalancers: 0/3   
network-resources   95s   services.nodeports: 4/5       

k get svc -n test
NAME                        TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)                                                     AGE
my-service-cip              ClusterIP   10.36.39.25    <none>        80/TCP                                                      31m
my-service-np   NodePort    10.36.36.151   <none>        80:30626/TCP,8081:25225/TCP,8083:28082/TCP,9000:26419/TCP   2m33s
```

We deploy a service of the **LoadBalancers** type in the amount of 1 with the publication of 1 port and get the use of the resource quota services.loadbalancers: 1/3   
services.nodeports: 5/5.

```
k get resourcequotas -n test
NAME                AGE     REQUEST                       LIMIT
compute-resources   20m     services.loadbalancers: 1/3   
network-resources   3m24s   services.nodeports: 5/5       

❯ k get svc -n test
NAME                        TYPE           CLUSTER-IP     EXTERNAL-IP   PORT(S)                                                     AGE
my-service-lb                  LoadBalancer   10.36.32.236   <pending>     80:32268/TCP                                                16s
my-service-cip              ClusterIP      10.36.39.25    <none>        80/TCP                                                      33m
my-service-np   NodePort       10.36.36.151   <none>        80:30626/TCP,8081:25225/TCP,8083:28082/TCP,9000:26419/TCP   4m17s
```

The described behavior has been tested on versions Kubernetes 1.20, 1.27-1.30, and the result is the same for all.

### What did you expect to happen?

In  the documentation https://kubernetes.io/docs/concepts/policy/resource-quotas/#object-count-quota the use of the resource quota for **services.nodeports** is described as **"The total number of Services of type NodePort that can exist in the namespace."**

In fact, each published port is considered for the services.nodeports resource quota, regardless of the specified type of Load Balancer or NodePort service.

### How can we reproduce it (as minimally and precisely as possible)?

Create Resource Quota

```
apiVersion: v1
kind: ResourceQuota
metadata:
  name: network-resources
spec:
  hard:
    services.nodeports: "5"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: compute-resources
spec:
  hard:
    services.loadbalancers: "1"
```

Create service

```
apiVersion: v1
kind: Service
metadata:
  name: my-service-cip
spec:
  selector:
    app.kubernetes.io/name: MyApp
  ports:
    - protocol: TCP
      port: 80
      targetPort: 9376
  type: ClusterIP
---
apiVersion: v1
kind: Service
metadata:
  name: my-service-np
spec:
  externalTrafficPolicy: Local
  ports:
  - name: api
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: probe
    port: 8081
    protocol: TCP
    targetPort: 8081
  - name: prof
    port: 8083
    protocol: TCP
    targetPort: 8083
  - name: metrics
    port: 9000
    protocol: TCP
    targetPort: 9000
  selector:
    app.kubernetes.io/name: my-service-np
  sessionAffinity: None
  type: NodePort
---
apiVersion: v1
kind: Service
metadata:
  name: my-service-lb
spec:
  externalTrafficPolicy: Local
  ports:
  - name: api
    port: 80
    protocol: TCP
    targetPort: 8080
  - name: probe
    port: 8081
    protocol: TCP
    targetPort: 8081
  - name: prof
    port: 8083
    protocol: TCP
    targetPort: 8083
  - name: metrics
    port: 9000
    protocol: TCP
    targetPort: 9000
  selector:
    app.kubernetes.io/name: my-service-lb
  sessionAffinity: None
  type: LoadBalancer
```

### Anything else we need to know?

_No response_

### Kubernetes version

<details>

The described behavior has been tested on versions Kubernetes 1.20, 1.27-1.30, and the result is the same for all.

</details>


### Cloud provider

<details>
none
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/

$ uname -a
Linux k8s-xc-01.stage.xxx.ru 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64 GNU/Linu
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>
conteinerd
</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>
CNI calico
</details>

--- end body ---

The issue describes a misconfiguration or bug in Kubernetes resource quotas where the count of NodePort services is incorrectly calculated based on the number of published ports rather than the number of NodePort services. This could lead to unexpected behavior in resource management, but it does not indicate a security vulnerability.