[WEB][42108] Kubernetes deployment: limit huge gap between limits/requests

[JulienBertrand]

\newpage

Sustainable Kubernetes deployment: limit huge gap between limits/requests

Platform

OS	OS version	Langage
-	-	Kubernetes (yaml)

Main caracteristics

ID	Title	Category	Sub-category
CRKUB004	limit limits/requests huge gaps	Deployment	Sustainable deploy

Severity / Remediation Cost

Severity	Remediation Cost
Minor	Minor

Rule short description

In a Kubernetes deployment file, define huge gaps between requests/limits values for cpu or ram indicate a problem in resource management.

Rule complete description

Text

When you specify a Pod, you can optionally specify how much of each resource a container needs. The most common resources to specify are CPU and memory (RAM); there are others.

When you specify the resource request for containers in a Pod, the kube-scheduler uses this information to decide which node to place the Pod on. When you specify a resource limit for a container, the kubelet enforces those limits so that the running container is not allowed to use more of that resource than the limit you set. The kubelet also reserves at least the request amount of that system resource specifically for that container to use.

the values are define like this:

• spec.containers[].resources.limits.cpu
• spec.containers[].resources.limits.memory
• spec.containers[].resources.requests.cpu
• spec.containers[].resources.requests.memory

HTML

<p>Defining the yaml file
    <code>---
apiVersion: v1
kind: Pod
metadata:
  name: frontend
spec:
  containers:
  - name: app
    image: images.my-company.example/app:v4
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"</code> as example to define ram and cpu limits/requests.</p>
<p>Limit gap between request/limit for ram and cpu to a maximum of x3</p>
<h2>Noncompliant Code Example</h2>
<pre>
    <code>---
apiVersion: v1
kind: Pod
metadata:
  name: frontend
spec:
  containers:
  - name: app
    image: images.my-company.example/app:v4
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "320Mi"
        cpu: "2500m"</code>
</pre>
<h2>Compliant Solution</h2>
<pre>
    <code>---
apiVersion: v1
kind: Pod
metadata:
  name: frontend
spec:
  containers:
  - name: app
    image: images.my-company.example/app:v4
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
      limits:
        memory: "128Mi"
        cpu: "500m"</code>
</pre>

Implementation principle

• Inspect yaml file and find 'kind: Pod'

• Inspect the found file and find:

  requests:
  memory: "64Mi"
  cpu: "250m"
  limits:
  memory: "128Mi"
  cpu: "500m"

• Compare the requests values and limits values for ram and cpu. Calculate the ratio.

• If the found ratio is above the limit, report the line