Skip to content

Modify rule S6869: Add examples for LimitRange #4004

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Jun 28, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 39 additions & 1 deletion rules/S6869/kubernetes/rule.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,8 @@ data, disrupting critical operations and impacting system reliability.

=== Code examples

To avoid potential issues, either specify a CPU limit for each container or create a resource of type `LimitRange` that sets a default CPU limit for all containers in a namespace.

==== Noncompliant code example

[source,yaml,diff-id=1,diff-type=noncompliant]
Expand All @@ -44,6 +46,18 @@ spec:
image: nginx
----

[source,yaml,diff-id=2,diff-type=noncompliant]
----
apiVersion: v1
kind: Pod
metadata:
name: nginx-ns-noncompliant
spec:
containers:
- name: nginx-ns-noncompliant # Noncompliant
image: nginx
----

==== Compliant solution

[source,yaml,diff-id=1,diff-type=compliant]
Expand All @@ -61,11 +75,35 @@ spec:
cpu: 0.5
----

[source,yaml,diff-id=2,diff-type=compliant]
----
apiVersion: v1
kind: LimitRange
metadata:
name: cpu-limit-range
namespace: default-cpu-example
spec:
limits:
- default:
cpu: 0.5
type: Container
---
apiVersion: v1
kind: Pod
metadata:
name: nginx-ns-compliant
namespace: default-cpu-example
spec:
containers:
- name: nginx-ns-compliant
image: nginx
----

=== How does this work?

A limit can be set through the property `resources.limits.cpu` of a
container. Alternatively, a default limit for a namespace can be set with
`LimitRange`.
`LimitRange` through `spec.limits[].default.cpu`.

== Resources

Expand Down