更新时间:2024-02-01 GMT+08:00
k8scontainerrequests
作用
限制CPU和内存的Request必须设置且小于配置的最大值。
策略实例示例
示例配置了CPU和内存的最大Request。
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerRequests metadata: name: container-must-have-requests spec: match: kinds: - apiGroups: [""] kinds: ["Pod"] parameters: cpu: "200m" memory: "1Gi"
符合策略实例的资源定义
CPU和内存的Request小于配置的最大值,符合策略实例。
apiVersion: v1 kind: Pod metadata: name: opa-allowed labels: owner: me.agilebank.demo spec: containers: - name: opa image: openpolicyagent/opa:0.9.2 args: - "run" - "--server" - "--addr=localhost:8080" resources: requests: cpu: "100m" memory: "1Gi"
不符合策略实例的资源定义
内存的Request大于约束的最大值,不符合策略实例。
apiVersion: v1 kind: Pod metadata: name: opa-disallowed labels: owner: me.agilebank.demo spec: containers: - name: opa image: openpolicyagent/opa:0.9.2 args: - "run" - "--server" - "--addr=localhost:8080" resources: requests: cpu: "100m" memory: "2Gi"
父主题: 使用策略定义库