Skip to content

Commit 144d185

Browse files
DTLPDTLP
committed
Add resource limit restriction policy
1 parent 1534d69 commit 144d185

File tree

5 files changed

+353
-3
lines changed

5 files changed

+353
-3
lines changed

‎kyverno/policies/pods/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ resources:
1313
- privileged.yaml
1414
- privilege-escalation.yaml
1515
- procMount.yaml
16+
- resources.yaml
1617
- Seccomp.yaml
1718
- SELinux.yaml
1819
- sysctls.yaml

‎kyverno/policies/pods/resources-cpu-limits.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: restrict-cpu-limit
5+
annotations:
6+
policies.kyverno.io/title: Restrict CPU Limit
7+
policies.kyverno.io/category: Other
8+
policies.kyverno.io/subject: Pod
9+
policies.kyverno.io/description: >-
10+
This policy restricts containers from setting the CPU limit above 6 cores.
11+
spec:
12+
validationFailureAction: Enforce
13+
background: true
14+
rules:
15+
- name: default
16+
match:
17+
resources:
18+
kinds:
19+
- Pod
20+
preconditions:
21+
all:
22+
- key: "{{ request.object.spec.containers[].resources.limits.cpu || '' }}"
23+
operator: NotEquals
24+
value: ""
25+
validate:
26+
message: "Containers must not set CPU limits over 6 cores."
27+
pattern:
28+
spec:
29+
containers:
30+
- resources:
31+
limits:
32+
cpu: "<=6"

‎kyverno/policies/pods/resources-memory-limits.yaml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: restrict-memory-limit
5+
annotations:
6+
policies.kyverno.io/title: Restrict Memory Limit
7+
policies.kyverno.io/category: Other
8+
policies.kyverno.io/subject: Pod
9+
policies.kyverno.io/description: >-
10+
This policy restricts containers from setting the memory limit above 24Gi.
11+
spec:
12+
validationFailureAction: Enforce
13+
background: true
14+
rules:
15+
- name: default
16+
match:
17+
resources:
18+
kinds:
19+
- Pod
20+
preconditions:
21+
all:
22+
- key: "{{ request.object.spec.containers[].resources.limits.memory || '' }}"
23+
operator: NotEquals
24+
value: ""
25+
validate:
26+
message: "Containers must not set memory limits over 24Gi."
27+
pattern:
28+
spec:
29+
containers:
30+
- resources:
31+
limits:
32+
memory: "<=24Gi"

‎kyverno/policies/pods/test/kyverno-test.yaml‎

Lines changed: 108 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,15 @@ policies:
33
- ../hostIPC.yaml
44
- ../hostNetwork.yaml
55
- ../privilege-escalation.yaml
6+
- ../resources-cpu-limits.yaml
7+
- ../resources-memory-limits.yaml
68
resources:
79
- test-hostIPC.yaml
810
- test-hostNetwork.yaml
911
- test-privilege-escalation.yaml
12+
- test-resources-limits.yaml
1013
results:
11-
# Test hostIPC
14+
# Test hostIPC
1215
- policy: disallow-host-ipc-pods
1316
rule: default
1417
resource: test-hostIPC-not-set
@@ -24,7 +27,7 @@ results:
2427
resource: test-hostIPC-set-to-true
2528
kind: Pod
2629
result: fail
27-
# Test hostNetwork
30+
# Test hostNetwork
2831
- policy: disallow-host-network-pods
2932
rule: default
3033
resource: test-hostNetwork-not-set
@@ -40,7 +43,7 @@ results:
4043
resource: test-hostNetwork-set-to-true
4144
kind: Pod
4245
result: fail
43-
# Test privilege escalation
46+
# Test privilege escalation
4447
- policy: disallow-privilege-escalation
4548
rule: default
4649
resource: test-privilege-escalation-not-set
@@ -56,3 +59,105 @@ results:
5659
resource: test-privilege-escalation-set-to-true
5760
kind: Pod
5861
result: fail
62+
# Test Restict CPU Limits
63+
- policy: restrict-cpu-limit
64+
rule: default
65+
resource: test-resource-limits-not-set
66+
kind: Pod
67+
result: skip
68+
- policy: restrict-cpu-limit
69+
rule: default
70+
resource: test-resource-limits-both-ok
71+
kind: Pod
72+
result: pass
73+
- policy: restrict-cpu-limit
74+
rule: default
75+
resource: test-resource-limits-cpu-too-high
76+
kind: Pod
77+
result: fail
78+
- policy: restrict-cpu-limit
79+
rule: default
80+
resource: test-resource-limits-memory-too-high
81+
kind: Pod
82+
result: pass
83+
- policy: restrict-cpu-limit
84+
rule: default
85+
resource: test-resource-limits-both-too-high
86+
kind: Pod
87+
result: fail
88+
- policy: restrict-cpu-limit
89+
rule: default
90+
resource: test-cpu-limit-ok
91+
kind: Pod
92+
result: pass
93+
- policy: restrict-cpu-limit
94+
rule: default
95+
resource: test-cpu-limit-decimal-ok
96+
kind: Pod
97+
result: pass
98+
- policy: restrict-cpu-limit
99+
rule: default
100+
resource: test-cpu-limit-millicores-ok
101+
kind: Pod
102+
result: pass
103+
- policy: restrict-cpu-limit
104+
rule: default
105+
resource: test-cpu-limit-too-high
106+
kind: Pod
107+
result: fail
108+
- policy: restrict-cpu-limit
109+
rule: default
110+
resource: test-cpu-limit-decimal-too-high
111+
kind: Pod
112+
result: fail
113+
- policy: restrict-cpu-limit
114+
rule: default
115+
resource: test-cpu-limit-millicores-too-high
116+
kind: Pod
117+
result: fail
118+
# Test Restict Memory Limits
119+
- policy: restrict-memory-limit
120+
rule: default
121+
resource: test-resource-limits-not-set
122+
kind: Pod
123+
result: skip
124+
- policy: restrict-memory-limit
125+
rule: default
126+
resource: test-resource-limits-both-ok
127+
kind: Pod
128+
result: pass
129+
- policy: restrict-memory-limit
130+
rule: default
131+
resource: test-resource-limits-cpu-too-high
132+
kind: Pod
133+
result: pass
134+
- policy: restrict-memory-limit
135+
rule: default
136+
resource: test-resource-limits-memory-too-high
137+
kind: Pod
138+
result: fail
139+
- policy: restrict-memory-limit
140+
rule: default
141+
resource: test-resource-limits-both-too-high
142+
kind: Pod
143+
result: fail
144+
- policy: restrict-memory-limit
145+
rule: default
146+
resource: test-memory-limit-ok
147+
kind: Pod
148+
result: pass
149+
- policy: restrict-memory-limit
150+
rule: default
151+
resource: test-memory-limit-mi-ok
152+
kind: Pod
153+
result: pass
154+
- policy: restrict-memory-limit
155+
rule: default
156+
resource: test-memory-limit-too-high
157+
kind: Pod
158+
result: fail
159+
- policy: restrict-memory-limit
160+
rule: default
161+
resource: test-memory-limit-mi-too-high
162+
kind: Pod
163+
result: fail

‎kyverno/policies/pods/test/test-resources-limits.yaml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: test-resource-limits-not-set
5+
spec:
6+
containers:
7+
- name: test
8+
image: test
9+
---
10+
apiVersion: v1
11+
kind: Pod
12+
metadata:
13+
name: test-resource-limits-both-ok
14+
spec:
15+
containers:
16+
- name: test
17+
image: test
18+
resources:
19+
limits:
20+
cpu: "6"
21+
memory: "24Gi"
22+
---
23+
apiVersion: v1
24+
kind: Pod
25+
metadata:
26+
name: test-resource-limits-cpu-too-high
27+
spec:
28+
containers:
29+
- name: test
30+
image: test
31+
resources:
32+
limits:
33+
cpu: "7"
34+
memory: "24Gi"
35+
---
36+
apiVersion: v1
37+
kind: Pod
38+
metadata:
39+
name: test-resource-limits-memory-too-high
40+
spec:
41+
containers:
42+
- name: test
43+
image: test
44+
resources:
45+
limits:
46+
cpu: "6"
47+
memory: "25Gi"
48+
---
49+
apiVersion: v1
50+
kind: Pod
51+
metadata:
52+
name: test-resource-limits-both-too-high
53+
spec:
54+
containers:
55+
- name: test
56+
image: test
57+
resources:
58+
limits:
59+
cpu: "7"
60+
memory: "25Gi"
61+
---
62+
apiVersion: v1
63+
kind: Pod
64+
metadata:
65+
name: test-cpu-limit-ok
66+
spec:
67+
containers:
68+
- name: test
69+
image: test
70+
resources:
71+
limits:
72+
cpu: "6"
73+
---
74+
apiVersion: v1
75+
kind: Pod
76+
metadata:
77+
name: test-cpu-limit-decimal-ok
78+
spec:
79+
containers:
80+
- name: test
81+
image: test
82+
resources:
83+
limits:
84+
cpu: "6.0"
85+
---
86+
apiVersion: v1
87+
kind: Pod
88+
metadata:
89+
name: test-cpu-limit-millicores-ok
90+
spec:
91+
containers:
92+
- name: test
93+
image: test
94+
resources:
95+
limits:
96+
cpu: "6000m"
97+
---
98+
apiVersion: v1
99+
kind: Pod
100+
metadata:
101+
name: test-cpu-limit-too-high
102+
spec:
103+
containers:
104+
- name: test
105+
image: test
106+
resources:
107+
limits:
108+
cpu: "7"
109+
---
110+
apiVersion: v1
111+
kind: Pod
112+
metadata:
113+
name: test-cpu-limit-decimal-too-high
114+
spec:
115+
containers:
116+
- name: test
117+
image: test
118+
resources:
119+
limits:
120+
cpu: "7.0"
121+
---
122+
apiVersion: v1
123+
kind: Pod
124+
metadata:
125+
name: test-cpu-limit-millicores-too-high
126+
spec:
127+
containers:
128+
- name: test
129+
image: test
130+
resources:
131+
limits:
132+
cpu: "7000m"
133+
---
134+
apiVersion: v1
135+
kind: Pod
136+
metadata:
137+
name: test-memory-limit-ok
138+
spec:
139+
containers:
140+
- name: test
141+
image: test
142+
resources:
143+
limits:
144+
memory: "24Gi"
145+
---
146+
apiVersion: v1
147+
kind: Pod
148+
metadata:
149+
name: test-memory-limit-mi-ok
150+
spec:
151+
containers:
152+
- name: test
153+
image: test
154+
resources:
155+
limits:
156+
memory: "24000Mi"
157+
---
158+
apiVersion: v1
159+
kind: Pod
160+
metadata:
161+
name: test-memory-limit-too-high
162+
spec:
163+
containers:
164+
- name: test
165+
image: test
166+
resources:
167+
limits:
168+
memory: "25Gi"
169+
---
170+
apiVersion: v1
171+
kind: Pod
172+
metadata:
173+
name: test-memory-limit-mi-too-high
174+
spec:
175+
containers:
176+
- name: test
177+
image: test
178+
resources:
179+
limits:
180+
memory: "25000Mi"

0 commit comments

Comments
 (0)