-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
The policy adds resource limits when they are missing in the containers. However, depending the requested resources and the policy configuration the users can hit a scenario where the policy mutates the resource adding a limit which is less than the requested resource. Therefore, Kubernetes will complain about it. To avoid this issue, the policy checks if the result of the mutation is valid. If it's not, reject the request to force the user to change the minimum request resource amount or adjust the policy configuration. Signed-off-by: José Guilherme Vanz <[email protected]>
- Loading branch information
Showing
5 changed files
with
320 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
178 changes: 178 additions & 0 deletions
178
test_data/deployment_with_requests_no_limit_resources_admission_request.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,178 @@ | ||
| { | ||
| "dryRun": false, | ||
| "kind": { | ||
| "group": "apps", | ||
| "kind": "Deployment", | ||
| "version": "v1" | ||
| }, | ||
| "name": "nginx", | ||
| "namespace": "default", | ||
| "object": { | ||
| "apiVersion": "apps/v1", | ||
| "kind": "Deployment", | ||
| "metadata": { | ||
| "annotations": { | ||
| "io.kubewarden.policy.echo.create": "true", | ||
| "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{\"io.kubewarden.policy.echo.create\":\"true\"},\"name\":\"nginx\",\"namespace\":\"default\"},\"spec\":{\"replicas\":0,\"selector\":{\"matchLabels\":{\"app\":\"nginx\"}},\"template\":{\"metadata\":{\"labels\":{\"app\":\"nginx\"}},\"spec\":{\"containers\":[{\"image\":\"nginx:latest\",\"name\":\"nginx\",\"ports\":[{\"containerPort\":80}]}]}}}}\n" | ||
| }, | ||
| "creationTimestamp": "2024-01-11T12:25:50Z", | ||
| "generation": 1, | ||
| "managedFields": [ | ||
| { | ||
| "apiVersion": "apps/v1", | ||
| "fieldsType": "FieldsV1", | ||
| "fieldsV1": { | ||
| "f:metadata": { | ||
| "f:annotations": { | ||
| ".": {}, | ||
| "f:io.kubewarden.policy.echo.create": {}, | ||
| "f:kubectl.kubernetes.io/last-applied-configuration": {} | ||
| } | ||
| }, | ||
| "f:spec": { | ||
| "f:progressDeadlineSeconds": {}, | ||
| "f:replicas": {}, | ||
| "f:revisionHistoryLimit": {}, | ||
| "f:selector": {}, | ||
| "f:strategy": { | ||
| "f:rollingUpdate": { | ||
| ".": {}, | ||
| "f:maxSurge": {}, | ||
| "f:maxUnavailable": {} | ||
| }, | ||
| "f:type": {} | ||
| }, | ||
| "f:template": { | ||
| "f:metadata": { | ||
| "f:labels": { | ||
| ".": {}, | ||
| "f:app": {} | ||
| } | ||
| }, | ||
| "f:spec": { | ||
| "f:containers": { | ||
| "k:{\"name\":\"nginx\"}": { | ||
| ".": {}, | ||
| "f:image": {}, | ||
| "f:imagePullPolicy": {}, | ||
| "f:name": {}, | ||
| "f:ports": { | ||
| ".": {}, | ||
| "k:{\"containerPort\":80,\"protocol\":\"TCP\"}": { | ||
| ".": {}, | ||
| "f:containerPort": {}, | ||
| "f:protocol": {} | ||
| } | ||
| }, | ||
| "f:resources": {}, | ||
| "f:terminationMessagePath": {}, | ||
| "f:terminationMessagePolicy": {} | ||
| } | ||
| }, | ||
| "f:dnsPolicy": {}, | ||
| "f:restartPolicy": {}, | ||
| "f:schedulerName": {}, | ||
| "f:securityContext": {}, | ||
| "f:terminationGracePeriodSeconds": {} | ||
| } | ||
| } | ||
| } | ||
| }, | ||
| "manager": "kubectl-client-side-apply", | ||
| "operation": "Update", | ||
| "time": "2024-01-11T12:25:50Z" | ||
| } | ||
| ], | ||
| "name": "nginx", | ||
| "namespace": "default", | ||
| "uid": "0663a366-270c-4d7c-a483-6f59d200fb22" | ||
| }, | ||
| "spec": { | ||
| "progressDeadlineSeconds": 600, | ||
| "replicas": 0, | ||
| "revisionHistoryLimit": 10, | ||
| "selector": { | ||
| "matchLabels": { | ||
| "app": "nginx" | ||
| } | ||
| }, | ||
| "strategy": { | ||
| "rollingUpdate": { | ||
| "maxSurge": "25%", | ||
| "maxUnavailable": "25%" | ||
| }, | ||
| "type": "RollingUpdate" | ||
| }, | ||
| "template": { | ||
| "metadata": { | ||
| "creationTimestamp": null, | ||
| "labels": { | ||
| "app": "nginx" | ||
| } | ||
| }, | ||
| "spec": { | ||
| "containers": [ | ||
| { | ||
| "image": "nginx:latest", | ||
| "imagePullPolicy": "Always", | ||
| "name": "nginx", | ||
| "ports": [ | ||
| { | ||
| "containerPort": 80, | ||
| "protocol": "TCP" | ||
| } | ||
| ], | ||
| "resources": { | ||
| "requests": { | ||
| "cpu": "1", | ||
| "memory": "250Mi" | ||
| }, | ||
| "limits": { | ||
| "cpu": "1" | ||
| } | ||
| }, | ||
| "terminationMessagePath": "/dev/termination-log", | ||
| "terminationMessagePolicy": "File" | ||
| } | ||
| ], | ||
| "dnsPolicy": "ClusterFirst", | ||
| "restartPolicy": "Always", | ||
| "schedulerName": "default-scheduler", | ||
| "securityContext": {}, | ||
| "terminationGracePeriodSeconds": 30 | ||
| } | ||
| } | ||
| }, | ||
| "status": {} | ||
| }, | ||
| "operation": "CREATE", | ||
| "options": { | ||
| "apiVersion": "meta.k8s.io/v1", | ||
| "fieldManager": "kubectl-client-side-apply", | ||
| "fieldValidation": "Strict", | ||
| "kind": "CreateOptions" | ||
| }, | ||
| "requestKind": { | ||
| "group": "apps", | ||
| "kind": "Deployment", | ||
| "version": "v1" | ||
| }, | ||
| "requestResource": { | ||
| "group": "apps", | ||
| "resource": "deployments", | ||
| "version": "v1" | ||
| }, | ||
| "resource": { | ||
| "group": "apps", | ||
| "resource": "deployments", | ||
| "version": "v1" | ||
| }, | ||
| "uid": "31403b86-f972-423e-8adb-c4bd79dc15cc", | ||
| "userInfo": { | ||
| "groups": [ | ||
| "system:masters", | ||
| "system:authenticated" | ||
| ], | ||
| "username": "system:admin" | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.