containerlimits support to skip cpu limit validation (#613)

* containerlimits support to skip cpu limit validation Signed-off-by: Xinhe Li <[email protected]> * f Signed-off-by: Xinhe Li <[email protected]> * f Signed-off-by: Xinhe Li <[email protected]> * f Signed-off-by: Xinhe Li <[email protected]> --------- Signed-off-by: Xinhe Li <[email protected]> Co-authored-by: Rita Zhang <[email protected]> Co-authored-by: Jaydip Gabani <[email protected]>
open-policy-agent · Jan 15, 2025 · 2ac0a02 · 2ac0a02
1 parent 357c95b
commit 2ac0a02
Show file tree

Hide file tree

Showing 19 changed files with 576 additions and 6 deletions.
diff --git a/artifacthub/library/general/containerlimits/1.1.0/artifacthub-pkg.yml b/artifacthub/library/general/containerlimits/1.1.0/artifacthub-pkg.yml
@@ -0,0 +1,25 @@
+version: 1.1.0
+name: k8scontainerlimits
+displayName: Container Limits
+createdAt: "2024-12-05T08:42:14Z"
+description: |-
+    Requires containers to have memory and CPU limits set and constrains limits to be within the specified maximum values.
+    https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+digest: 80cdb57a413ec205ca940639fb78b7cb4b400fb820557654909578d0ddd0b5ef
+license: Apache-2.0
+homeURL: https://open-policy-agent.github.io/gatekeeper-library/website/containerlimits
+keywords:
+    - gatekeeper
+    - open-policy-agent
+    - policies
+readme: |-
+    # Container Limits
+    Requires containers to have memory and CPU limits set and constrains limits to be within the specified maximum values.
+    https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+install: |-
+    ### Usage
+    ```shell
+    kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/artifacthub/library/general/containerlimits/1.1.0/template.yaml
+    ```
+provider:
+    name: Gatekeeper Library
diff --git a/artifacthub/library/general/containerlimits/1.1.0/kustomization.yaml b/artifacthub/library/general/containerlimits/1.1.0/kustomization.yaml
@@ -0,0 +1,2 @@
+resources:
+  - template.yaml
diff --git a/...library/general/containerlimits/1.1.0/samples/container-ignore-cpu-limits/constraint.yaml b/...library/general/containerlimits/1.1.0/samples/container-ignore-cpu-limits/constraint.yaml
@@ -0,0 +1,12 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sContainerLimits
+metadata:
+  name: container-must-have-limits
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+  parameters:
+    cpu: "-1"
+    memory: "1Gi"
diff --git a/...ry/general/containerlimits/1.1.0/samples/container-ignore-cpu-limits/example_allowed.yaml b/...ry/general/containerlimits/1.1.0/samples/container-ignore-cpu-limits/example_allowed.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: opa-allowed
+spec:
+  containers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
+      resources:
+        limits:
+          memory: "1Gi"
diff --git a/...general/containerlimits/1.1.0/samples/container-ignore-cpu-limits/example_disallowed.yaml b/...general/containerlimits/1.1.0/samples/container-ignore-cpu-limits/example_disallowed.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: opa-disallowed
+spec:
+  containers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
+      resources:
+        limits:
+          memory: "2Gi"
diff --git a/.../library/general/containerlimits/1.1.0/samples/container-must-have-limits/constraint.yaml b/.../library/general/containerlimits/1.1.0/samples/container-must-have-limits/constraint.yaml
@@ -0,0 +1,12 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sContainerLimits
+metadata:
+  name: container-must-have-limits
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+  parameters:
+    cpu: "200m"
+    memory: "1Gi"
diff --git a/...ary/general/containerlimits/1.1.0/samples/container-must-have-limits/example_allowed.yaml b/...ary/general/containerlimits/1.1.0/samples/container-must-have-limits/example_allowed.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: opa-allowed
+  labels:
+    owner: me.agilebank.demo
+spec:
+  containers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
+      resources:
+        limits:
+          cpu: "100m"
+          memory: "1Gi"
diff --git a/.../general/containerlimits/1.1.0/samples/container-must-have-limits/example_disallowed.yaml b/.../general/containerlimits/1.1.0/samples/container-must-have-limits/example_disallowed.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: opa-disallowed
+  labels:
+    owner: me.agilebank.demo
+spec:
+  containers:
+    - name: opa
+      image: openpolicyagent/opa:0.9.2
+      args:
+        - "run"
+        - "--server"
+        - "--addr=localhost:8080"
+      resources:
+        limits:
+          cpu: "100m"
+          memory: "2Gi"
diff --git a/artifacthub/library/general/containerlimits/1.1.0/suite.yaml b/artifacthub/library/general/containerlimits/1.1.0/suite.yaml
@@ -0,0 +1,29 @@
+kind: Suite
+apiVersion: test.gatekeeper.sh/v1alpha1
+metadata:
+  name: containerlimits
+tests:
+- name: container-limits
+  template: template.yaml
+  constraint: samples/container-must-have-limits/constraint.yaml
+  cases:
+  - name: example-allowed
+    object: samples/container-must-have-limits/example_allowed.yaml
+    assertions:
+    - violations: no
+  - name: example-disallowed
+    object: samples/container-must-have-limits/example_disallowed.yaml
+    assertions:
+    - violations: yes
+- name: container-limits-ignore-cpu
+  template: template.yaml
+  constraint: samples/container-ignore-cpu-limits/constraint.yaml
+  cases:
+  - name: example-allowed
+    object: samples/container-ignore-cpu-limits/example_allowed.yaml
+    assertions:
+    - violations: no
+  - name: example-disallowed
+    object: samples/container-ignore-cpu-limits/example_disallowed.yaml
+    assertions:
+    - violations: yes