Help Center/ Ubiquitous Cloud Native Service/ User Guide/ Policy Center/ Policy Definition Library/ k8scontainerlimits
Updated on 2024-02-01 GMT+08:00
View PDF

k8scontainerlimits

Basic Information

  • Policy type: compliance
  • Recommended level: L1
  • Effective resource type: Pod
  • Parameter

    cpu: String

    memory: String

    exemptImages: String array

Function

The CPU and memory Limit must be set for the container and must be less than the maximum values.

Policy Example

The example shows that the maximum CPU usage of the matched object is 200 MB and the maximum memory usage is 1 GB.

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerLimits
metadata:
  name: container-must-have-limits
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    cpu: "200m"
    memory: "1Gi"

Resource Definition That Complies with the Policy

Limit of the CPU and memory complies with the policy instance.

apiVersion: v1
kind: Pod
metadata:
  name: opa-allowed
  labels:
    owner: me.agilebank.demo
spec:
  containers:
    - name: opa
      image: openpolicyagent/opa:0.9.2
      args:
        - "run"
        - "--server"
        - "--addr=localhost:8080"
      resources:
        limits:
          cpu: "100m"
          memory: "1Gi"

Resource Definition That Does Not Comply with the Policy

The memory Limit exceeds the maximum value, which does not comply with the policy instance.