Enforce container resources without max/min values #185
Conversation
Signed-off-by: Oleg Vorobev <[email protected]>
olegy2008
force-pushed
the
enforce-container-resources
branch
from
6ecb737 to
769257d
Compare
|
@maxsmythe @ritazh is there any chance to get your review/opinion about this? |
|
Sorry for the slow response :/ I like the idea of this CT! I haven't had time to look through the tests, but the overall code LGTM. Any chance this could be updated to also support ephemeral containers, per #191 ? |
|
Hey @maxsmythe! |
| object: samples/container-must-have-limits-and-requests/example_allowed1.yaml | ||
| assertions: | ||
| - violations: no | ||
| - name: example-disallowed1 |
There was a problem hiding this comment.
nit: I wonder if we could name these tests to explain what they are testing?
There was a problem hiding this comment.
Renamed tests, but not sure if it's more readable/clear now, do you have any naming conventions?
There was a problem hiding this comment.
No conventions as yet, since the test function is fairly new, but this is much more clear. Thank you for doing this!
| It is recommended that users use the fully-qualified Docker image name (e.g. start with a domain name) | ||
| in order to avoid unexpectedly exempting images from an untrusted repository. | ||
| type: array | ||
| items: |
There was a problem hiding this comment.
Is it possible to add a regex check for the string so that users get an error if they type anything other than "cpu" or "memory"?
There was a problem hiding this comment.
Added enum to validate the values.
Signed-off-by: Oleg Vorobev <[email protected]>
Signed-off-by: Oleg Vorobev <[email protected]>
...must-have-cpu-requests-memory-limits-and-requests/only-memory-limits-defined-disallowed.yaml
Show resolved
Hide resolved
|
LGTM |
I've created this template to only enforce the presence of resources defined in the constraint without specifying min/max values like in
containerrequestsandcontainerlimits.That's my first time using
regoso would appreciate any suggestions to make it look and work better if possible.