k8sreplicalimits

Basic Information

• Policy type: compliance
• Recommended level: L1
• Effective resource type: *
• Parameter

  ranges:
    min_replicas: Integer
    max_replicas: Integer

Function

Objects (such as Deployments and ReplicaSets) with the spec.replicas field must be within the defined range.

Policy Example

The following policy instance shows the resource types for which the policy definition takes effect. The value of parameters ranges from 3 to 50.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sReplicaLimits
metadata:
  name: replica-limits
spec:
  match:
    kinds:
      - apiGroups: ["apps"]
        kinds: ["Deployment"]
  parameters:
    ranges:
    - min_replicas: 3
      max_replicas: 50

Resource Definition That Complies with the Policy

replicas is set to 3, which complies with the policy instance.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: allowed-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 3
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80

Resource Definition That Does Not Comply with the Policy

replicas is set to 100, which does not comply with the policy instance.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: disallowed-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 100
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80