k8scontainerratios
作用
限制容器的limit对request比例的最大值。
策略实例示例
限制容器的limit对request比例的最大值为1,cpu的limit对request比例最大值为10。
apiVersion: constraints.gatekeeper.sh/v1beta1 kind: K8sContainerRatios metadata: name: container-must-meet-memory-and-cpu-ratio spec: match: kinds: - apiGroups: [""] kinds: ["Pod"] parameters: ratio: "1" cpuRatio: "10"
符合策略实例的资源定义
cpu比例为4,内存比例为1,符合约束。
apiVersion: v1 kind: Pod metadata: name: opa-allowed labels: owner: me.agilebank.demo spec: containers: - name: opa image: openpolicyagent/opa:0.9.2 args: - "run" - "--server" - "--addr=localhost:8080" resources: limits: cpu: "4" memory: "2Gi" requests: cpu: "1" memory: "2Gi"
不符合策略实例的资源定义
示例一:CPU比例为40,不符合约束。
apiVersion: v1 kind: Pod metadata: name: opa-disallowed labels: owner: me.agilebank.demo spec: containers: - name: opa image: openpolicyagent/opa:0.9.2 args: - "run" - "--server" - "--addr=localhost:8080" resources: limits: cpu: "4" memory: "2Gi" requests: cpu: "100m" memory: "2Gi"
示例二:内存比例为20,不符合约束。
apiVersion: v1 kind: Pod metadata: name: opa-disallowed labels: owner: me.agilebank.demo spec: containers: - name: opa image: openpolicyagent/opa:0.9.2 args: - "run" - "--server" - "--addr=localhost:8080" resources: limits: cpu: "800m" memory: "2Gi" requests: cpu: "100m" memory: "100Mi"