Project: KICS (Provisioning / Security & Compliance)
File: 48a5beba-e4c0-4584-a2aa-e6894e4cf424.md

title: Pod or Container Without ResourceQuota hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 48a5beba-e4c0-4584-a2aa-e6894e4cf424 Query name: Pod or Container Without ResourceQuota Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Each namespace should have a ResourceQuota policy associated to limit the total amount of resources Pods, Containers and PersistentVolumeClaims can consume<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" apiVersion: v1 kind: Pod metadata: name: pod1 namespace: myNewPod spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="4" apiVersion: v1 kind: Pod metadata: name: pod2 spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="5" apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd-elasticsearch namespace: my-kube-system labels: k8s-app: fluentd-logging spec: selector: matchLabels: name: fluentd-elasticsearch template: metadata: labels: name: fluentd-elasticsearch spec: tolerations: key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule containers: name: fluentd-elasticsearch image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2 resources: limits: memory: 200Mi requests: cpu: 100m memory: 200Mi volumeMounts: name: varlog mountPath: /var/log name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true terminationGracePeriodSeconds: 30 volumes: name: varlog hostPath: path: /var/log name: varlibdockercontainers hostPath: path: /var/lib/docker/containers ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="5" kind: PersistentVolumeClaim apiVersion: v1 metadata: name: webcontent namespace: k8s-test9 annotations: volume.alpha.kubernetes.io/storage-class: default spec: accessModes: [ReadWriteOnce] resources: requests: storage: 5Gi ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: pod2 namespace: myNewPod2 spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" apiVersion: v1 kind: ResourceQuota metadata: name: pods-high namespace: myNewPod2 spec: hard: cpu: "1000" memory: 200Gi pods: "10" scopeSelector: matchExpressions: operator : In scopeName: PriorityClass values: ["high"] ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd-elasticsearch namespace: my-kube-system2 labels: k8s-app: fluentd-logging spec: selector: matchLabels: name: fluentd-elasticsearch template: metadata: labels: name: fluentd-elasticsearch spec: tolerations: key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule containers: name: fluentd-elasticsearch image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2 resources: limits: memory: 200Mi requests: cpu: 100m memory: 200Mi volumeMounts: name: varlog mountPath: /var/log name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true terminationGracePeriodSeconds: 30 volumes: name: varlog hostPath: path: /var/log name: varlibdockercontainers hostPath: path: /var/lib/docker/containers apiVersion: v1 kind: ResourceQuota metadata: name: pods-high namespace: my-kube-system2 spec: hard: cpu: "1000" memory: 200Gi pods: "10" scopeSelector: matchExpressions: operator : In scopeName: PriorityClass values: ["high"] ```