Repository: Checkmarx/kics (language: python)

Issue:
Potentially wrong queries
there are existing queries that point out non-issues.
specifically, having requests.memory/cpu != limits.memory/cpu is not an issue (but a best practice).
resource limits are supposed to help users avoid OOM/throttling, while resource requests make sure resources are actually allocated for the containers.

even in the [https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/](link attached) as help for these queries, the example shows limits>requests.

### Expected Behavior
containers having requests.memory/cpu != limits.memory/cpu will not trigger an issue.

queries:

aafa7d94-62de-4fbf-8838-b69ee217b0e6
9d43040e-e703-4e16-8bfe-8d4da10fa7e6
aee3c7d2-a811-4201-90c7-11c028be9a46

should be removed

### Actual Behavior

containers having requests.memory/cpu != limits.memory/cpu trigger an issue.


Discussion / hints:
Do you suggest to to remove these queries or change their severity (e.g. informational) ?
well I'd remove them
Hi @giladshahar ,

Thank you for your inputs on this.
We asked our AppSec team to have a look on this. We will update you asap.

(APPSEC-2347)

Fix patch:
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/metadata.json b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/metadata.json
deleted file mode 100644
index c25235b526b..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/metadata.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "id": "9d43040e-e703-4e16-8bfe-8d4da10fa7e6",
-  "queryName": "Container CPU Requests Not Equal To Its Limits",
-  "severity": "LOW",
-  "category": "Best Practices",
-  "descriptionText": "A Pod's Containers must have the same CPU requests as limits set, which is recommended to avoid resource DDOS of the node during spikes. This means the 'requests.cpu' must equal 'limits.cpu', and both be defined.",
-  "descriptionUrl": "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
-  "platform": "Kubernetes",
-  "descriptionID": "3e1c6d16",
-  "cwe": ""
-}
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/query.rego b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/query.rego
deleted file mode 100644
index b539d26fc71..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/query.rego
+++ /dev/null
@@ -1,54 +0,0 @@
-package Cx
-
-import data.generic.common as common_lib
-import data.generic.k8s as k8sLib
-
-types := {"initContainers", "containers"}
-rec := {"requests", "limits"}
-
-CxPolicy[result] {
-	document := input.document[i]
-	document.kind == k8sLib.valid_pod_spec_kind_list[_]
-	specInfo := k8sLib.getSpecInfo(document)
-	container := specInfo.spec[types[x]][c]
-
-	has_request_or_limits(container)
-	not common_lib.valid_key(container.resources[rec[t]], "cpu")
-
-	result := {
-		"documentId": document.id,
-		"resourceType": document.kind,
-		"resourceName": document.metadata.name,
-		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.resources.%s", [document.metadata.name, specInfo.path, types[x], container.name, rec[t]]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("spec.%s[%s].resources.%s.cpu should be defined", [types[x], container.name, rec[t]]),
-		"keyActualValue": sprintf("spec.%s[%s].resources.%s.cpu is not defined", [types[x], container.name, rec[t]]),
-		"searchLine": common_lib.build_search_line(split(specInfo.path, "."), [types[x], c, "resources", rec[t]]),
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	document.kind == k8sLib.valid_pod_spec_kind_list[_]
-	specInfo := k8sLib.getSpecInfo(document)
-	container := specInfo.spec[types[x]][c]
-
-	container.resources.requests.cpu != container.resources.limits.cpu
-
-	result := {
-		"documentId": document.id,
-		"resourceType": document.kind,
-		"resourceName": document.metadata.name,
-		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.resources", [document.metadata.name, specInfo.path, types[x], container.name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("spec.%s[%s].resources.requests.cpu is equal to spec.%s[%s].resources.limits.cpu", [types[x], container.name, types[x], container.name]),
-		"keyActualValue": sprintf("spec.%s[%s].resources.requests.cpu is not equal to spec.%s[%s].resources.limits.cpu", [types[x], container.name, types[x], container.name]),
-		"searchLine": common_lib.build_search_line(split(specInfo.path, "."), [types[x], c, "resources"]),
-	}
-}
-
-has_request_or_limits(x){
-	common_lib.valid_key(x.resources[rec["requests"]],"cpu")
-}else{
-	common_lib.valid_key(x.resources[rec["limits"]],"cpu")
-}
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/metadata.json b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/metadata.json
deleted file mode 100644
index 8a08d4a9654..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/metadata.json
+++ /dev/null
@@ -1,11 +0,0 @@
-{
-  "id": "aafa7d94-62de-4fbf-8838-b69ee217b0e6",
-  "queryName": "Container Memory Requests Not Equal To Its Limits",
-  "severity": "LOW",
-  "category": "Resource Management",
-  "descriptionText": "A Pod's Containers must have the same Memory requests as limits set, which is recommended to avoid resource DDOS of the node during spikes. This means the 'requests.memory' must equal 'limits.memory', and both be defined.",
-  "descriptionUrl": "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/",
-  "platform": "Kubernetes",
-  "descriptionID": "0c15063c",
-  "cwe": ""
-}
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/query.rego b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/query.rego
deleted file mode 100644
index dc2b504268a..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/query.rego
+++ /dev/null
@@ -1,57 +0,0 @@
-package Cx
-
-import data.generic.common as common_lib
-import data.generic.k8s as k8sLib
-
-types := {"initContainers", "containers"}
-rec := {"requests", "limits"}
-
-CxPolicy[result] {
-	document := input.document[i]
-	document.kind == k8sLib.valid_pod_spec_kind_list[_]
-	specInfo := k8sLib.getSpecInfo(document)
-	container := specInfo.spec[types[x]][c]
-
-    has_request_or_limits(container)
-	not common_lib.valid_key(container.resources[rec[t]], "memory")
-
-	result := {
-		"documentId": document.id,
-		"resourceType": document.kind,
-		"resourceName": document.metadata.name,
-		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.resources.%s", [document.metadata.name,specInfo.path, types[x], container.name, rec[t]]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("spec.%s[%s].resources.%s.memory should be defined", [types[x], container.name, rec[t]]),
-		"keyActualValue": sprintf("spec.%s[%s].resources.%s.memory is not defined", [types[x], container.name, rec[t]]),
-		"searchLine": common_lib.build_search_line(split(specInfo.path, "."), [types[x], c, "resources", rec[t]])
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	document.kind == k8sLib.valid_pod_spec_kind_list[_]
-
-	specInfo := k8sLib.getSpecInfo(document)
-	types := {"initContainers", "containers"}
-
-	container := specInfo.spec[types[x]][c]
-
-	container.resources.requests.memory != container.resources.limits.memory
-
-	result := {
-		"documentId": document.id,
-		"resourceType": document.kind,
-		"resourceName": document.metadata.name,
-		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.resources", [document.metadata.name, specInfo.path,types[x], container.name]),
-		"issueType": "IncorrectValue",
-		"keyExpectedValue": sprintf("spec.%s[%s].resources.requests.memory is equal to spec.%s[%s].resources.limits.memory", [types[x], container.name, types[x], container.name]),
-		"keyActualValue": sprintf("spec.%s[%s].resources.requests.memory is not equal to spec.%s[%s].resources.limits.memory", [types[x], container.name, types[x], container.name]),
-		"searchLine": common_lib.build_search_line(split(specInfo.path, "."), [types[x], c, "resources"])
-	}
-}
-
-has_request_or_limits(x){
-	common_lib.valid_key(x.resources[rec["requests"]],"memory")
-}else{
-	common_lib.valid_key(x.resources[rec["limits"]],"memory")
-}


Test patch:
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/negative.yaml b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/negative.yaml
deleted file mode 100644
index 9045cb76a00..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/negative.yaml
+++ /dev/null
@@ -1,25 +0,0 @@
-#this code is a correct code for which the query should not find any result
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "128Mi"
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
-  - name: log-aggregator
-    image: images.my-company.example/log-aggregator:v6
-    resources:
-      requests:
-        memory: "128Mi"
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
\ No newline at end of file
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/negative1.yaml b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/negative1.yaml
deleted file mode 100644
index 17b3ca99f22..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/negative1.yaml
+++ /dev/null
@@ -1,21 +0,0 @@
-#this code is a correct code for which the query should not find any result
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "128Mi"
-      limits:
-        memory: "128Mi"
-  - name: log-aggregator
-    image: images.my-company.example/log-aggregator:v6
-    resources:
-      requests:
-        memory: "128Mi"
-      limits:
-        memory: "128Mi"
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive.yaml b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive.yaml
deleted file mode 100644
index 5706027ac69..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-#this is a problematic code where the query should report a result(s)
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "128Mi"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
-  - name: log-aggregator
-    image: images.my-company.example/log-aggregator:v6
-    resources:
-      requests:
-        memory: "128Mi"
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-  - name: app2
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "64Mi"
-        cpu: "250m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
\ No newline at end of file
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive2.yaml b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive2.yaml
deleted file mode 100644
index f94dfc40f58..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive2.yaml
+++ /dev/null
@@ -1,16 +0,0 @@
-apiVersion: serving.knative.dev/v1
-kind: Revision
-metadata:
-  name: dummy-rev
-  namespace: knative-sequence
-spec:
-  containers:
-  - name: app2
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "64Mi"
-        cpu: "250m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
diff --git a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive_expected_result.json b/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive_expected_result.json
deleted file mode 100644
index 61a80c2247e..00000000000
--- a/assets/queries/k8s/container_cpu_requests_not_equal_to_its_limits/test/positive_expected_result.json
+++ /dev/null
@@ -1,26 +0,0 @@
-[
-  {
-    "queryName": "Container CPU Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 11,
-    "fileName": "positive.yaml"
-  },
-  {
-    "queryName": "Container CPU Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 22,
-    "fileName": "positive.yaml"
-  },
-  {
-    "queryName": "Container CPU Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 26,
-    "fileName": "positive.yaml"
-  },
-  {
-    "queryName": "Container CPU Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 10,
-    "fileName": "positive2.yaml"
-  }
-]
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/negative.yaml b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/negative.yaml
deleted file mode 100644
index 23541fe6fc9..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/negative.yaml
+++ /dev/null
@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "128Mi"
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
-  - name: log-aggregator
-    image: images.my-company.example/log-aggregator:v6
-    resources:
-      requests:
-        memory: "128Mi"
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/negative1.yaml b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/negative1.yaml
deleted file mode 100644
index 23c4aca5619..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/negative1.yaml
+++ /dev/null
@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        cpu: "500m"
-      limits:
-        cpu: "500m"
-  - name: log-aggregator
-    image: images.my-company.example/log-aggregator:v6
-    resources:
-      requests:
-        cpu: "500m"
-      limits:
-        cpu: "500m"
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive.yaml b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive.yaml
deleted file mode 100644
index 8d994b59d70..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive.yaml
+++ /dev/null
@@ -1,32 +0,0 @@
-#this is a problematic code where the query should report a result(s)
-apiVersion: v1
-kind: Pod
-metadata:
-  name: frontend
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
-  - name: log-aggregator
-    image: images.my-company.example/log-aggregator:v6
-    resources:
-      requests:
-        memory: "128Mi"
-        cpu: "500m"
-      limits:
-        cpu: "500m"
-  - name: app2
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        memory: "64Mi"
-        cpu: "250m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
\ No newline at end of file
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive2.yaml b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive2.yaml
deleted file mode 100644
index 1075b5fc435..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive2.yaml
+++ /dev/null
@@ -1,15 +0,0 @@
-apiVersion: serving.knative.dev/v1
-kind: Revision
-metadata:
-  name: dummy-rev
-  namespace: knative-sequence
-spec:
-  containers:
-  - name: app
-    image: images.my-company.example/app:v4
-    resources:
-      requests:
-        cpu: "500m"
-      limits:
-        memory: "128Mi"
-        cpu: "500m"
diff --git a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive_expected_result.json b/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive_expected_result.json
deleted file mode 100644
index 998df986586..00000000000
--- a/assets/queries/k8s/container_memory_requests_not_equal_to_its_limits/test/positive_expected_result.json
+++ /dev/null
@@ -1,26 +0,0 @@
-[
-  {
-    "queryName": "Container Memory Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 11,
-    "fileName": "positive.yaml"
-  },
-  {
-    "queryName": "Container Memory Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 22,
-    "fileName": "positive.yaml"
-  },
-  {
-    "queryName": "Container Memory Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 26,
-    "fileName": "positive.yaml"
-  },
-  {
-    "queryName": "Container Memory Requests Not Equal To Its Limits",
-    "severity": "LOW",
-    "line": 11,
-    "fileName": "positive2.yaml"
-  }
-]