Skip to content

Commit

Permalink
Merge pull request #12307 from ComplianceAsCode/resource_limit
Browse files Browse the repository at this point in the history
OCPBUGS-304: exclude rhacs-operator namespace from resource limit rules
  • Loading branch information
yuumasato authored Sep 4, 2024
2 parents d7020ee + 5798710 commit a172683
Show file tree
Hide file tree
Showing 6 changed files with 57 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -25,9 +25,7 @@ identifiers: {}

references:
nist: SC-6

{{% set jqfilter = '[ .items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select( .spec.template.spec.containers[].resources.requests.cpu == null or .spec.template.spec.containers[].resources.requests.memory == null or .spec.template.spec.containers[].resources.limits.cpu == null or .spec.template.spec.containers[].resources.limits.memory == null ) | .metadata.name ]' %}}

{{% set jqfilter = '[ .items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.namespace != "rhacs-operator" and ({{if ne .var_daemonset_limit_namespaces_exempt_regex "None"}}.metadata.namespace | test("{{.var_daemonset_limit_namespaces_exempt_regex}}") | not{{else}}true{{end}})) | select( .spec.template.spec.containers[].resources.requests.cpu == null or .spec.template.spec.containers[].resources.requests.memory == null or .spec.template.spec.containers[].resources.limits.cpu == null or .spec.template.spec.containers[].resources.limits.memory == null ) | .metadata.name ]' %}}
ocil_clause: 'Resource requests and limits is not set'

ocil: |-
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ identifiers: {}
references:
nist: SC-6

{{% set jqfilter = '[ .items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select( .spec.template.spec.containers[].resources.requests.cpu == null or .spec.template.spec.containers[].resources.requests.memory == null or .spec.template.spec.containers[].resources.limits.cpu == null or .spec.template.spec.containers[].resources.limits.memory == null ) | .metadata.name ]' %}}
{{% set jqfilter = '[ .items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.namespace != "rhacs-operator" and ({{if ne .var_deployment_limit_namespaces_exempt_regex "None"}}.metadata.namespace | test("{{.var_deployment_limit_namespaces_exempt_regex}}") | select( .spec.template.spec.containers[].resources.requests.cpu == null or .spec.template.spec.containers[].resources.requests.memory == null or .spec.template.spec.containers[].resources.limits.cpu == null or .spec.template.spec.containers[].resources.limits.memory == null ) | .metadata.name ]' %}}

ocil_clause: 'Resource requests and limits is not set'

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ identifiers: {}
references:
nist: SC-6

{{% set jqfilter = '[ .items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select( .spec.template.spec.containers[].resources.requests.cpu == null or .spec.template.spec.containers[].resources.requests.memory == null or .spec.template.spec.containers[].resources.limits.cpu == null or .spec.template.spec.containers[].resources.limits.memory == null ) | .metadata.name ]' %}}
{{% set jqfilter = '[ .items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.namespace != "rhacs-operator" and ({{if ne .var_statefulset_limit_namespaces_exempt_regex "None"}}.metadata.namespace | test("{{.var_statefulset_limit_namespaces_exempt_regex}}") | select( .spec.template.spec.containers[].resources.requests.cpu == null or .spec.template.spec.containers[].resources.requests.memory == null or .spec.template.spec.containers[].resources.limits.cpu == null or .spec.template.spec.containers[].resources.limits.memory == null ) | .metadata.name ]' %}}

ocil_clause: 'Resource requests and limits is not set'

Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
documentation_complete: true

title: 'Namespaces exempt of Daemonset Resource Limit'

description: |-
Namespaces regular expression explicitly allowed
through daemonset resource filters, e.g. setting value to
"namespace1|namespace2" will exempt namespace
"namespace1" and "namespace2" for daemonset resource limit checks.

type: string

operator: equals

interactive: true

options:
default: "None"
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
documentation_complete: true

title: 'Namespaces exempt of Deployment Resource Limit'

description: |-
Namespaces regular expression explicitly allowed
through deployment resource filters, e.g. setting value to
"namespace1|namespace2" will exempt namespace
"namespace1" and "namespace2" for deployment resource limit checks.

type: string

operator: equals

interactive: true

options:
default: "None"
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
documentation_complete: true

title: 'Namespaces exempt of Statefulset Resource Limit'

description: |-
Namespaces regular expression explicitly allowed
through statefulset resource filters, e.g. setting value to
"namespace1|namespace2" will exempt namespace
"namespace1" and "namespace2" for statefulset resource limit checks.

type: string

operator: equals

interactive: true

options:
default: "None"

0 comments on commit a172683

Please sign in to comment.