github.com/khulnasoft-lab/defsec@v1.0.5-0.20230827010352-5e9f46893d95/rules/kubernetes/policies/general/CPU_requests_not_specified.rego (about) 1 # METADATA 2 # title: "CPU requests not specified" 3 # description: "When containers have resource requests specified, the scheduler can make better decisions about which nodes to place pods on, and how to deal with resource contention." 4 # scope: package 5 # schemas: 6 # - input: schema["kubernetes"] 7 # related_resources: 8 # - https://cloud.google.com/blog/products/containers-kubernetes/kubernetes-best-practices-resource-requests-and-limits 9 # custom: 10 # id: KSV015 11 # avd_id: AVD-KSV-0015 12 # severity: LOW 13 # short_code: no-unspecified-cpu-requests 14 # recommended_action: "Set 'containers[].resources.requests.cpu'." 15 # input: 16 # selector: 17 # - type: kubernetes 18 package builtin.kubernetes.KSV015 19 20 import data.lib.kubernetes 21 import data.lib.utils 22 23 default failRequestsCPU = false 24 25 # getRequestsCPUContainers returns all containers which have set resources.requests.cpu 26 getRequestsCPUContainers[container] { 27 container := kubernetes.containers[_] 28 utils.has_key(container.resources.requests, "cpu") 29 } 30 31 # getNoRequestsCPUContainers returns all containers which have not set 32 # resources.requests.cpu 33 getNoRequestsCPUContainers[container] { 34 container := kubernetes.containers[_] 35 not getRequestsCPUContainers[container] 36 } 37 38 deny[res] { 39 output := getNoRequestsCPUContainers[_] 40 msg := kubernetes.format(sprintf("Container '%s' of %s '%s' should set 'resources.requests.cpu'", [output.name, kubernetes.kind, kubernetes.name])) 41 res := result.new(msg, output) 42 }