Skip to content

Commit 5b3d426

Browse files
DTLPDTLP
committed
Add resource limit restriction policy
1 parent 1534d69 commit 5b3d426

File tree

4 files changed

+338
-3
lines changed

4 files changed

+338
-3
lines changed

‎kyverno/policies/pods/kustomization.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ resources:
1313
- privileged.yaml
1414
- privilege-escalation.yaml
1515
- procMount.yaml
16+
- resource-limits.yaml
1617
- Seccomp.yaml
1718
- SELinux.yaml
1819
- sysctls.yaml

‎kyverno/policies/pods/resource-limits.yaml‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
apiVersion: kyverno.io/v1
2+
kind: ClusterPolicy
3+
metadata:
4+
name: restrict-resource-limits
5+
annotations:
6+
policies.kyverno.io/title: Restrict Resource Limits
7+
policies.kyverno.io/category: Other
8+
policies.kyverno.io/subject: Pod
9+
policies.kyverno.io/description: >-
10+
This policy restricts containers from setting CPU limit above 6 cores and
11+
memory limit above 24Gi.
12+
spec:
13+
validationFailureAction: Enforce
14+
background: true
15+
rules:
16+
- name: cpu
17+
match:
18+
resources:
19+
kinds:
20+
- Pod
21+
preconditions:
22+
all:
23+
- key: "{{ request.object.spec.containers[].resources.limits.cpu || '' }}"
24+
operator: NotEquals
25+
value: ""
26+
validate:
27+
message: "Containers must not set CPU limits over 6 cores."
28+
pattern:
29+
spec:
30+
containers:
31+
- resources:
32+
limits:
33+
cpu: "<=6"
34+
- name: memory
35+
match:
36+
resources:
37+
kinds:
38+
- Pod
39+
preconditions:
40+
all:
41+
- key: "{{ request.object.spec.containers[].resources.limits.memory || '' }}"
42+
operator: NotEquals
43+
value: ""
44+
validate:
45+
message: "Containers must not set memory limits over 24Gi."
46+
pattern:
47+
spec:
48+
containers:
49+
- resources:
50+
limits:
51+
memory: "<=24Gi"

‎kyverno/policies/pods/test/kyverno-test.yaml‎

Lines changed: 106 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,14 @@ policies:
33
- ../hostIPC.yaml
44
- ../hostNetwork.yaml
55
- ../privilege-escalation.yaml
6+
- ../resource-limits.yaml
67
resources:
78
- test-hostIPC.yaml
89
- test-hostNetwork.yaml
910
- test-privilege-escalation.yaml
11+
- test-resource-limits.yaml
1012
results:
11-
# Test hostIPC
13+
# Test hostIPC
1214
- policy: disallow-host-ipc-pods
1315
rule: default
1416
resource: test-hostIPC-not-set
@@ -24,7 +26,7 @@ results:
2426
resource: test-hostIPC-set-to-true
2527
kind: Pod
2628
result: fail
27-
# Test hostNetwork
29+
# Test hostNetwork
2830
- policy: disallow-host-network-pods
2931
rule: default
3032
resource: test-hostNetwork-not-set
@@ -40,7 +42,7 @@ results:
4042
resource: test-hostNetwork-set-to-true
4143
kind: Pod
4244
result: fail
43-
# Test privilege escalation
45+
# Test privilege escalation
4446
- policy: disallow-privilege-escalation
4547
rule: default
4648
resource: test-privilege-escalation-not-set
@@ -56,3 +58,104 @@ results:
5658
resource: test-privilege-escalation-set-to-true
5759
kind: Pod
5860
result: fail
61+
# Test Restict Resource Limits
62+
- policy: restrict-resource-limits
63+
rule: cpu
64+
resource: test-resource-limits-not-set
65+
kind: Pod
66+
result: skip
67+
- policy: restrict-resource-limits
68+
rule: memory
69+
resource: test-resource-limits-not-set
70+
kind: Pod
71+
result: skip
72+
- policy: restrict-resource-limits
73+
rule: cpu
74+
resource: test-resource-limits-both-ok
75+
kind: Pod
76+
result: pass
77+
- policy: restrict-resource-limits
78+
rule: memory
79+
resource: test-resource-limits-both-ok
80+
kind: Pod
81+
result: pass
82+
- policy: restrict-resource-limits
83+
rule: cpu
84+
resource: test-resource-limits-cpu-too-high
85+
kind: Pod
86+
result: fail
87+
- policy: restrict-resource-limits
88+
rule: memory
89+
resource: test-resource-limits-cpu-too-high
90+
kind: Pod
91+
result: pass
92+
- policy: restrict-resource-limits
93+
rule: cpu
94+
resource: test-resource-limits-memory-too-high
95+
kind: Pod
96+
result: pass
97+
- policy: restrict-resource-limits
98+
rule: memory
99+
resource: test-resource-limits-memory-too-high
100+
kind: Pod
101+
result: fail
102+
- policy: restrict-resource-limits
103+
rule: cpu
104+
resource: test-resource-limits-both-too-high
105+
kind: Pod
106+
result: fail
107+
- policy: restrict-resource-limits
108+
rule: memory
109+
resource: test-resource-limits-both-too-high
110+
kind: Pod
111+
result: fail
112+
- policy: restrict-resource-limits
113+
rule: cpu
114+
resource: test-cpu-limit-ok
115+
kind: Pod
116+
result: pass
117+
- policy: restrict-resource-limits
118+
rule: cpu
119+
resource: test-cpu-limit-decimal-ok
120+
kind: Pod
121+
result: pass
122+
- policy: restrict-resource-limits
123+
rule: cpu
124+
resource: test-cpu-limit-millicores-ok
125+
kind: Pod
126+
result: pass
127+
- policy: restrict-resource-limits
128+
rule: cpu
129+
resource: test-cpu-limit-too-high
130+
kind: Pod
131+
result: fail
132+
- policy: restrict-resource-limits
133+
rule: cpu
134+
resource: test-cpu-limit-decimal-too-high
135+
kind: Pod
136+
result: fail
137+
- policy: restrict-resource-limits
138+
rule: cpu
139+
resource: test-cpu-limit-millicores-too-high
140+
kind: Pod
141+
result: fail
142+
- policy: restrict-resource-limits
143+
rule: memory
144+
resource: test-memory-limit-ok
145+
kind: Pod
146+
result: pass
147+
- policy: restrict-resource-limits
148+
rule: memory
149+
resource: test-memory-limit-mi-ok
150+
kind: Pod
151+
result: pass
152+
- policy: restrict-resource-limits
153+
rule: memory
154+
resource: test-memory-limit-too-high
155+
kind: Pod
156+
result: fail
157+
- policy: restrict-resource-limits
158+
rule: memory
159+
resource: test-memory-limit-mi-too-high
160+
kind: Pod
161+
result: fail

‎kyverno/policies/pods/test/test-resource-limits.yaml‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
apiVersion: v1
2+
kind: Pod
3+
metadata:
4+
name: test-resource-limits-not-set
5+
spec:
6+
containers:
7+
- name: test
8+
image: test
9+
---
10+
apiVersion: v1
11+
kind: Pod
12+
metadata:
13+
name: test-resource-limits-both-ok
14+
spec:
15+
containers:
16+
- name: test
17+
image: test
18+
resources:
19+
limits:
20+
cpu: "6"
21+
memory: "24Gi"
22+
---
23+
apiVersion: v1
24+
kind: Pod
25+
metadata:
26+
name: test-resource-limits-cpu-too-high
27+
spec:
28+
containers:
29+
- name: test
30+
image: test
31+
resources:
32+
limits:
33+
cpu: "7"
34+
memory: "24Gi"
35+
---
36+
apiVersion: v1
37+
kind: Pod
38+
metadata:
39+
name: test-resource-limits-memory-too-high
40+
spec:
41+
containers:
42+
- name: test
43+
image: test
44+
resources:
45+
limits:
46+
cpu: "6"
47+
memory: "25Gi"
48+
---
49+
apiVersion: v1
50+
kind: Pod
51+
metadata:
52+
name: test-resource-limits-both-too-high
53+
spec:
54+
containers:
55+
- name: test
56+
image: test
57+
resources:
58+
limits:
59+
cpu: "7"
60+
memory: "25Gi"
61+
---
62+
apiVersion: v1
63+
kind: Pod
64+
metadata:
65+
name: test-cpu-limit-ok
66+
spec:
67+
containers:
68+
- name: test
69+
image: test
70+
resources:
71+
limits:
72+
cpu: "6"
73+
---
74+
apiVersion: v1
75+
kind: Pod
76+
metadata:
77+
name: test-cpu-limit-decimal-ok
78+
spec:
79+
containers:
80+
- name: test
81+
image: test
82+
resources:
83+
limits:
84+
cpu: "6.0"
85+
---
86+
apiVersion: v1
87+
kind: Pod
88+
metadata:
89+
name: test-cpu-limit-millicores-ok
90+
spec:
91+
containers:
92+
- name: test
93+
image: test
94+
resources:
95+
limits:
96+
cpu: "6000m"
97+
---
98+
apiVersion: v1
99+
kind: Pod
100+
metadata:
101+
name: test-cpu-limit-too-high
102+
spec:
103+
containers:
104+
- name: test
105+
image: test
106+
resources:
107+
limits:
108+
cpu: "7"
109+
---
110+
apiVersion: v1
111+
kind: Pod
112+
metadata:
113+
name: test-cpu-limit-decimal-too-high
114+
spec:
115+
containers:
116+
- name: test
117+
image: test
118+
resources:
119+
limits:
120+
cpu: "7.0"
121+
---
122+
apiVersion: v1
123+
kind: Pod
124+
metadata:
125+
name: test-cpu-limit-millicores-too-high
126+
spec:
127+
containers:
128+
- name: test
129+
image: test
130+
resources:
131+
limits:
132+
cpu: "7000m"
133+
---
134+
apiVersion: v1
135+
kind: Pod
136+
metadata:
137+
name: test-memory-limit-ok
138+
spec:
139+
containers:
140+
- name: test
141+
image: test
142+
resources:
143+
limits:
144+
memory: "24Gi"
145+
---
146+
apiVersion: v1
147+
kind: Pod
148+
metadata:
149+
name: test-memory-limit-mi-ok
150+
spec:
151+
containers:
152+
- name: test
153+
image: test
154+
resources:
155+
limits:
156+
memory: "24000Mi"
157+
---
158+
apiVersion: v1
159+
kind: Pod
160+
metadata:
161+
name: test-memory-limit-too-high
162+
spec:
163+
containers:
164+
- name: test
165+
image: test
166+
resources:
167+
limits:
168+
memory: "25Gi"
169+
---
170+
apiVersion: v1
171+
kind: Pod
172+
metadata:
173+
name: test-memory-limit-mi-too-high
174+
spec:
175+
containers:
176+
- name: test
177+
image: test
178+
resources:
179+
limits:
180+
memory: "25000Mi"

0 commit comments

Comments
 (0)