Skip to content

Commit 449f33f

Browse files
suhasgummasuhasgumma
committed
C-0050
1 parent 31311bf commit 449f33f

File tree

4 files changed

+109
-20
lines changed

4 files changed

+109
-20
lines changed

‎configuration/policy-configuration-definition.yaml

+4-12
Original file line numberDiff line numberDiff line change
@@ -16,21 +16,13 @@ spec:
1616
type: object
1717
properties:
1818
cpuLimitMax:
19-
items:
20-
type: integer
21-
type: array
19+
type: integer
2220
cpuLimitMin:
23-
items:
24-
type: integer
25-
type: array
21+
type: integer
2622
cpuRequestMax:
27-
items:
28-
type: integer
29-
type: array
23+
type: integer
3024
cpuRequestMin:
31-
items:
32-
type: integer
33-
type: array
25+
type: integer
3426
imageRepositoryAllowList:
3527
items:
3628
type: string

‎controls/C-0050/policy.yaml

+50
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
apiVersion: admissionregistration.k8s.io/v1alpha1
2+
kind: ValidatingAdmissionPolicy
3+
metadata:
4+
name: "kubescape-c-0050-deny-resources-with-cpu-limit-or-request-not-set"
5+
spec:
6+
failurePolicy: Fail
7+
paramKind:
8+
apiVersion: kubescape.io/v1
9+
kind: ControlConfiguration
10+
matchConstraints:
11+
resourceRules:
12+
- apiGroups: [""]
13+
apiVersions: ["v1"]
14+
operations: ["CREATE", "UPDATE"]
15+
resources: ["pods"]
16+
- apiGroups: ["apps"]
17+
apiVersions: ["v1"]
18+
operations: ["CREATE", "UPDATE"]
19+
resources: ["deployments","replicasets","daemonsets","statefulsets"]
20+
- apiGroups: ["batch"]
21+
apiVersions: ["v1"]
22+
operations: ["CREATE", "UPDATE"]
23+
resources: ["jobs","cronjobs"]
24+
validations:
25+
- expression: >
26+
object.kind != 'Pod' || object.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
27+
params.settings.cpuLimitMin <= int(container.resources.requests.cpu) &&
28+
params.settings.cpuLimitMax >= int(container.resources.requests.cpu)) &&
29+
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&
30+
params.settings.cpuLimitMin <= int(container.resources.limits.cpu) &&
31+
params.settings.cpuLimitMax >= int(container.resources.limits.cpu)))
32+
message: "Pods contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"
33+
34+
- expression: >
35+
['Deployment','ReplicaSet','DaemonSet','StatefulSet','Job'].all(kind, object.kind != kind) || object.spec.template.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
36+
params.settings.cpuLimitMin <= int(container.resources.requests.cpu) &&
37+
params.settings.cpuLimitMax >= int(container.resources.requests.cpu)) &&
38+
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&
39+
params.settings.cpuLimitMin <= int(container.resources.limits.cpu) &&
40+
params.settings.cpuLimitMax >= int(container.resources.limits.cpu)))
41+
message: "Workloads contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"
42+
43+
- expression: >
44+
object.kind != 'CronJob' || object.spec.jobTemplate.spec.containers.all(container, (!(!(has(container.resources)) || !(has(container.resources.requests)) || !(has(container.resources.requests.cpu))) &&
45+
params.settings.cpuLimitMin <= int(container.resources.requests.cpu) &&
46+
params.settings.cpuLimitMax >= int(container.resources.requests.cpu)) &&
47+
(!(!(has(container.resources.limits)) || !(has(container.resources.limits.cpu))) &&
48+
params.settings.cpuLimitMin <= int(container.resources.limits.cpu) &&
49+
params.settings.cpuLimitMax >= int(container.resources.limits.cpu)))
50+
message: "CronJob contains container/s with cpu limit or request not set or they are not in the specified range! (see more at https://hub.armosec.io/docs/c-0050)"

‎controls/C-0050/tests.json

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
[
2+
{
3+
"name": "Pod with container having cpu-request and limits not set is blocked",
4+
"template": "pod.yaml",
5+
"expected": "fail",
6+
"field_change_list": [
7+
]
8+
},
9+
{
10+
"name": "Pod with container having cpu request set and limits not set is blocked",
11+
"template": "pod.yaml",
12+
"expected": "fail",
13+
"field_change_list": [
14+
"spec.containers.[0].resources.requests.cpu=2"
15+
]
16+
},
17+
{
18+
"name": "Pod with container having cpu request and limits set and both values in the limit is allowed",
19+
"template": "pod.yaml",
20+
"expected": "pass",
21+
"field_change_list": [
22+
"spec.containers.[0].resources.requests.cpu=3",
23+
"spec.containers.[0].resources.limits.cpu=3"
24+
]
25+
},
26+
{
27+
"name": "Pod with container having cpu request and limits set and values not in the limit is blocked",
28+
"template": "pod.yaml",
29+
"expected": "fail",
30+
"field_change_list": [
31+
"spec.containers.[0].resources.requests.cpu=1",
32+
"spec.containers.[0].resources.limits.cpu=6"
33+
]
34+
},
35+
{
36+
"name": "Deployment with container having cpu-request and limits not set is blocked",
37+
"template": "deployment.yaml",
38+
"expected": "fail",
39+
"field_change_list": [
40+
]
41+
},
42+
{
43+
"name": "Deployment with container having cpu request and limits set and both values in the limit is allowed",
44+
"template": "deployment.yaml",
45+
"expected": "pass",
46+
"field_change_list": [
47+
"spec.template.spec.containers.[0].resources.requests.cpu=3",
48+
"spec.template.spec.containers.[0].resources.limits.cpu=3"
49+
]
50+
}
51+
]

‎test-resources/default-control-configuration.yaml

+4-8
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,10 @@ kind: ControlConfiguration
33
metadata:
44
name: placeholder
55
settings:
6-
cpuLimitMax:
7-
- 0
8-
cpuLimitMin:
9-
- 0
10-
cpuRequestMax:
11-
- 0
12-
cpuRequestMin:
13-
- 0
6+
cpuLimitMax: 5
7+
cpuLimitMin: 1
8+
cpuRequestMax: 5
9+
cpuRequestMin: 1
1410
imageRepositoryAllowList:
1511
- gcr.io
1612
insecureCapabilities:

0 commit comments

Comments
 (0)