Project: KICS (Provisioning / Security & Compliance)
File: 4a20ebac-1060-4c81-95d1-1f7f620e983b.md

title: Pod or Container Without LimitRange hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 4a20ebac-1060-4c81-95d1-1f7f620e983b Query name: Pod or Container Without LimitRange Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Insecure Configurations URL: Each namespace should have a LimitRange policy associated to ensure that resource allocations of Pods, Containers and PersistentVolumeClaims do not exceed the defined boundaries<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="5" apiVersion: v1 kind: Pod metadata: name: frontend1 namespace: myPod spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="4" apiVersion: v1 kind: Pod metadata: name: frontend2 spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="5" apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd-elasticsearch namespace: kube-system labels: k8s-app: fluentd-logging spec: selector: matchLabels: name: fluentd-elasticsearch template: metadata: labels: name: fluentd-elasticsearch spec: tolerations: key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule containers: name: fluentd-elasticsearch image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2 resources: limits: memory: 200Mi requests: cpu: 100m memory: 200Mi volumeMounts: name: varlog mountPath: /var/log name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true terminationGracePeriodSeconds: 30 volumes: name: varlog hostPath: path: /var/log name: varlibdockercontainers hostPath: path: /var/lib/docker/containers ``` <details><summary>Positive test num. 4 - yaml file</summary> ```yaml hl_lines="5" kind: PersistentVolumeClaim apiVersion: v1 metadata: name: webcontent namespace: k8s-test9 annotations: volume.alpha.kubernetes.io/storage-class: default spec: accessModes: [ReadWriteOnce] resources: requests: storage: 5Gi ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: frontend namespace: myPod2 spec: containers: name: app image: images.my-company.example/app:v4 securityContext: allowPrivilegeEscalation: false resources: requests: memory: "64Mi" cpu: "250m" limits: memory: "128Mi" cpu: "500m" apiVersion: v1 kind: LimitRange metadata: name: cpu-min-max-demo-lr namespace: myPod2 spec: limits: max: cpu: "800m" min: cpu: "200m" type: Container ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: apps/v1 kind: DaemonSet metadata: name: fluentd-elasticsearch namespace: kube-system2 labels: k8s-app: fluentd-logging spec: selector: matchLabels: name: fluentd-elasticsearch template: metadata: labels: name: fluentd-elasticsearch spec: tolerations: key: node-role.kubernetes.io/master operator: Exists effect: NoSchedule containers: name: fluentd-elasticsearch image: quay.io/fluentd_elasticsearch/fluentd:v2.5.2 resources: limits: memory: 200Mi requests: cpu: 100m memory: 200Mi volumeMounts: name: varlog mountPath: /var/log name: varlibdockercontainers mountPath: /var/lib/docker/containers readOnly: true terminationGracePeriodSeconds: 30 volumes: name: varlog hostPath: path: /var/log name: varlibdockercontainers hostPath: path: /var/lib/docker/containers apiVersion: v1 kind: LimitRange metadata: name: cpu-min-max-demo-lr namespace: kube-system2 spec: limits: max: cpu: "800m" min: cpu: "200m" type: Container ```