rego opa policy to check if resources are provided for deployment in kubernetes

Question

I'm checking if key resources.limits is provided in deployment kubernetes using OPA rego code. Below is the code, I'm trying to fetch the resources.limits key and it is always returning TRUE. Regardless of resources provided or not.

    package resourcelimits

    violation[{"msg": msg}] {
    some container; input.request.object.spec.template.spec.containers[container]
    not container.resources.limits.memory
    msg := "Resources for the pod needs to be provided"

Vasilii Angapov · Accepted Answer · 2022-01-10 13:12:15Z

1

You can try something like this:

import future.keywords.in

violation[{"msg": msg}] {
    input.request.kind.kind == "Deployment"

    some container in input.request.object.spec.template.spec.containers
    not container.resources.limits.memory
    msg := sprintf("Container '%v/%v' does not have memory limits", [input.request.object.metadata.name, container.name])
}

answered Jan 10, 2022 at 13:12

Vasilii Angapov

9,08020 silver badges37 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

3br10ee032 Over a year ago

We are on lower version of OPA and it does not have future.keywords.in library, Is their any other way to do?

Collectives™ on Stack Overflow

rego opa policy to check if resources are provided for deployment in kubernetes

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related