init

02-validation/01-resource-validation/require-resource-limits.yaml

@@ -0,0 +1,49 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: require-resource-limits
+  annotations:
+    policies.kyverno.io/title: "Обязательные resource limits"
+    policies.kyverno.io/category: Resources
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Каждый контейнер (включая init и ephemeral) обязан иметь
+      limits.memory и limits.cpu. Без лимитов контейнер может
+      потребить все ресурсы ноды и убить соседей (noisy neighbor).
+spec:
+  validationFailureAction: Enforce
+  background: true
+  rules:
+  - name: check-container-limits
+    match:
+      resources:
+        kinds:
+        - Pod
+    exclude:
+      resources:
+        namespaces:
+        - kube-system
+        - kyverno
+    validate:
+      message: >-
+        Контейнер '{{ element.name }}' в поде '{{ request.object.metadata.name }}'
+        (namespace: {{ request.object.metadata.namespace }}) не имеет resource limits.
+
+        Добавьте в манифест:
+          resources:
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+
+        Документация: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+      foreach:
+      - list: >-
+          request.object.spec.containers[] |
+          merge(request.object.spec.initContainers[] || `[]`, @) |
+          merge(request.object.spec.ephemeralContainers[] || `[]`, @)
+        pattern:
+          resources:
+            limits:
+              memory: "?*"
+              cpu: "?*"