cpu-and-memory-limits-required.yaml

# Copyright 2024 Google LLC
#
# This is “Software” that is licensed under the “General Software” section of
# the Service Specific Terms (https://cloud.google.com/terms/service-terms) for
# usage in accordance with the following “Scope of Use”: This file may only be
# used on an Anthos cluster, including any associated ci/cd use. “Anthos
# cluster” is defined as “A Cluster (of any kind) registered to a fleet project
# where the Anthos API is enabled”.
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredResources
metadata:
  name: nist-sp-800-190-cpu-and-memory-limits-required
  labels:
    policycontroller.gke.io/bundleName: nist-sp-800-190
  annotations:
    policycontroller.gke.io/bundleVersion: "202403.0"
    policycontroller.gke.io/constraintData: |-
      "{
        bundleName: 'nist-sp-800-190',
        bundleDisplayName: 'NIST SP 800-190',
        bundleLink: 'https://cloud.google.com/anthos-config-management/docs/how-to/using-nist-sp-800-190',
        bundleVersion: '202403.0',
        bundleDescription: 'Use the NIST SP 800-190 policy bundle with Policy Controller to evaluate the compliance of your cluster resources against some aspects of the NIST SP 800-190 Appendix B controls.',
        controlNumbers: '[SC-6]',
        severity: 'UNSPECIFIED',
        description: 'All workload pods must specify `cpu` and `memory` limits.',
        remediation: 'Pods must specify `cpu` and `memory` limits. See "Resource Management for Pods and Containers" for more information: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/',
        minimumTemplateLibraryVersion: '1.12.0',
        constraintHash: 'a6df682567a187b272f8bb7fb0671d44b83536d7c934fd69c908b8ef34775a14'
      }"
spec:
  enforcementAction: dryrun
  match:
    kinds:
      - apiGroups:
          - ""
        kinds:
          - Pod
    excludedNamespaces:
      - kube-system
      - istio-system
      - asm-system
      - config-management-system
      - config-management-monitoring
      - resource-group-system
      - cert-manager
      - gatekeeper-system
      - gmp-system
      - gmp-public
      - gke-gmp-system
      - gke-system
      - gke-connect
      - anthos-identity-service
      - apigee
      - apigee-system
      - gke-managed-cim
  parameters:
    limits:
      - cpu
      - memory
    exemptImages:
      - gcr.io/anthos-baremetal-release/*
      - gcr.io/gkeconnect/*