Kubernetes Resource Rules Evaluations (SL022)

Checks to make sure Kubernetes cpu and memory allocations are valid.

Description

Checks kubernetes/base/deployment.yaml and kubernetes/prod/deployment.yaml to ensure that resource requests and limits are configured properly for cpu and memory to avoid issues with pod availability in higher environments. Values are pulled from the base deployment and then overwritten if values are present in the prod deployment.yaml.

Rationale

Avoiding issues with pod availability and resource usage in production.

Findings

WARNING
- CPU request value not configured
- Memory request value not configured
- Memory limit value not configured
- Memory limit value not equal to memory request value

Noncompliant

Missing resource values

# deployment.yaml (missing values)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: my-service
        resources:
          requests:
            cpu: 1000m
          limits:
            memory: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: my-service
        resources:
          requests:
            memory: 1Gi
          limits:
            memory: 1Gi
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: my-service
        resources:
          requests:
            cpu: 1000m
            memory: 1Gi

Mismatched memory values

# deployment.yaml (mismatched)
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: my-service
        resources:
          requests:
            cpu: 1000m
            memory: 1Gi
          limits:
            memory: 2Gi

Compliant

Correctly configured resource values

# deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-service
spec:
  replicas: 3
  template:
    spec:
      containers:
      - name: my-service
        resources:
          requests:
            cpu: 1000m
            memory: 1Gi
          limits:
            memory: 1Gi

Configuration

This rule has no configuration.