requiredresources-template.yaml

apiVersion: templates.gatekeeper.sh/v1beta1
kind: ConstraintTemplate
metadata:
  name: k8srequiredresources
spec:
  crd:
    spec:
      names:
        kind: K8sRequiredResources
        listKind: K8sRequiredResourcesList
        plural: k8srequiredresources
        singular: k8srequiredresources
      validation:
        # Schema for the `parameters` field
        openAPIV3Schema:
          properties:
            requests_cpu:
              type: string
            requests_memory:
              type: string
            limits_cpu:
              type: string
            limits_memory:
              type: string
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |

        # input.review.object.spec.template.spec.containers
        # input.review.object.spec.containers
        # input.review.object.spec.jobTemplate.spec.template.spec.containers

        package k8srequiredresources

        missing(obj, field) = true {
          not obj[field]
        }

        missing(obj, field) = true {
          obj[field] == ""
        }

        canonify_cpu(orig) = new {
          is_number(orig)
          new := orig * 1000
        }

        canonify_cpu(orig) = new {
          not is_number(orig)
          endswith(orig, "m")
          new := to_number(replace(orig, "m", ""))
        }

        canonify_cpu(orig) = new {
          not is_number(orig)
          not endswith(orig, "m")
          re_match("^[0-9]+$", orig)
          new := to_number(orig) * 1000
        }

        # 10 ** 18
        mem_multiple("E") = 1000000000000000000 { true }

        # 10 ** 15
        mem_multiple("P") = 1000000000000000 { true }

        # 10 ** 12
        mem_multiple("T") = 1000000000000 { true }

        # 10 ** 9
        mem_multiple("G") = 1000000000 { true }

        # 10 ** 6
        mem_multiple("M") = 1000000 { true }

        # 10 ** 3
        mem_multiple("K") = 1000 { true }

        # 10 ** 0
        mem_multiple("") = 1 { true }

        # 2 ** 10
        mem_multiple("Ki") = 1024 { true }

        # 2 ** 20
        mem_multiple("Mi") = 1048576 { true }

        # 2 ** 30
        mem_multiple("Gi") = 1073741824 { true }

        # 2 ** 40
        mem_multiple("Ti") = 1099511627776 { true }

        # 2 ** 50
        mem_multiple("Pi") = 1125899906842624 { true }

        # 2 ** 60
        mem_multiple("Ei") = 1152921504606846976 { true }

        get_suffix(mem) = suffix {
          not is_string(mem)
          suffix := ""
        }

        get_suffix(mem) = suffix {
          is_string(mem)
          suffix := substring(mem, count(mem) - 1, -1)
          mem_multiple(suffix)
        }

        get_suffix(mem) = suffix {
          is_string(mem)
          suffix := substring(mem, count(mem) - 2, -1)
          mem_multiple(suffix)
        }

        get_suffix(mem) = suffix {
          is_string(mem)
          not substring(mem, count(mem) - 1, -1)
          not substring(mem, count(mem) - 2, -1)
          suffix := ""
        }

        canonify_mem(orig) = new {
          is_number(orig)
          new := orig
        }

        canonify_mem(orig) = new {
          not is_number(orig)
          suffix := get_suffix(orig)
          raw := replace(orig, suffix, "")
          new := to_number(raw) * mem_multiple(suffix)
        }


        #####################################################################################################################
        # spec.template.spec.containers
        #####################################################################################################################

        #### limits


        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          cpu_orig := container.resources.limits.cpu
          not canonify_cpu(cpu_orig)
          msg := sprintf("container <%v> cpu limit <%v> could not be parsed", [container.name, cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          mem_orig := container.resources.limits.memory
          not canonify_mem(mem_orig)
          msg := sprintf("container <%v> memory limit <%v> could not be parsed", [container.name, mem_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          not container.resources
          msg := sprintf("container <%v> has no resources", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          not container.resources.limits
          msg := sprintf("container <%v> has no resource limits", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          missing(container.resources.limits, "cpu")
          msg := sprintf("container <%v> has no cpu limit", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          missing(container.resources.limits, "memory")
          msg := sprintf("container <%v> has no memory limit", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          cpu_orig := container.resources.limits.cpu
          cpu := canonify_cpu(cpu_orig)
          max_cpu_orig := input.parameters.limits_cpu
          max_cpu := canonify_cpu(max_cpu_orig)
          cpu > max_cpu
          msg := sprintf("container <%v> cpu limit <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          mem_orig := container.resources.limits.memory
          mem := canonify_mem(mem_orig)
          max_mem_orig := input.parameters.limits_memory
          max_mem := canonify_mem(max_mem_orig)
          mem > max_mem
          msg := sprintf("container <%v> memory limit <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])
        }


        #### requests

      
        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          cpu_orig := container.resources.requests.cpu
          not canonify_cpu(cpu_orig)
          msg := sprintf("container <%v> cpu request <%v> could not be parsed", [container.name, cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          mem_orig := container.resources.requests.memory
          not canonify_mem(mem_orig)
          msg := sprintf("container <%v> memory request <%v> could not be parsed", [container.name, mem_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          not container.resources
          msg := sprintf("container <%v> has no resources", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          not container.resources.requests
          msg := sprintf("container <%v> has no resource requests", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          missing(container.resources.requests, "cpu")
          msg := sprintf("container <%v> has no cpu request", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          missing(container.resources.requests, "memory")
          msg := sprintf("container <%v> has no memory request", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          cpu_orig := container.resources.requests.cpu
          cpu := canonify_cpu(cpu_orig)
          max_cpu_orig := input.parameters.requests_cpu
          max_cpu := canonify_cpu(max_cpu_orig)
          cpu > max_cpu
          msg := sprintf("container <%v> cpu request <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.template.spec.containers[_]
          mem_orig := container.resources.requests.memory
          mem := canonify_mem(mem_orig)
          max_mem_orig := input.parameters.requests_memory
          max_mem := canonify_mem(max_mem_orig)
          mem > max_mem
          msg := sprintf("container <%v> memory request <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])
        }


        #####################################################################################################################
        # spec.jobTemplate.spec.template.spec.containers
        #####################################################################################################################

        #### limits


        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          cpu_orig := container.resources.limits.cpu
          not canonify_cpu(cpu_orig)
          msg := sprintf("container <%v> cpu limit <%v> could not be parsed", [container.name, cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          mem_orig := container.resources.limits.memory
          not canonify_mem(mem_orig)
          msg := sprintf("container <%v> memory limit <%v> could not be parsed", [container.name, mem_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          not container.resources
          msg := sprintf("container <%v> has no resources", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          not container.resources.limits
          msg := sprintf("container <%v> has no resource limits", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          missing(container.resources.limits, "cpu")
          msg := sprintf("container <%v> has no cpu limit", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          missing(container.resources.limits, "memory")
          msg := sprintf("container <%v> has no memory limit", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          cpu_orig := container.resources.limits.cpu
          cpu := canonify_cpu(cpu_orig)
          max_cpu_orig := input.parameters.limits_cpu
          max_cpu := canonify_cpu(max_cpu_orig)
          cpu > max_cpu
          msg := sprintf("container <%v> cpu limit <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          mem_orig := container.resources.limits.memory
          mem := canonify_mem(mem_orig)
          max_mem_orig := input.parameters.limits_memory
          max_mem := canonify_mem(max_mem_orig)
          mem > max_mem
          msg := sprintf("container <%v> memory limit <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])
        }


        #### requests

      
        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          cpu_orig := container.resources.requests.cpu
          not canonify_cpu(cpu_orig)
          msg := sprintf("container <%v> cpu request <%v> could not be parsed", [container.name, cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          mem_orig := container.resources.requests.memory
          not canonify_mem(mem_orig)
          msg := sprintf("container <%v> memory request <%v> could not be parsed", [container.name, mem_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          not container.resources
          msg := sprintf("container <%v> has no resources", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          not container.resources.requests
          msg := sprintf("container <%v> has no resource requests", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          missing(container.resources.requests, "cpu")
          msg := sprintf("container <%v> has no cpu request", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          missing(container.resources.requests, "memory")
          msg := sprintf("container <%v> has no memory request", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          cpu_orig := container.resources.requests.cpu
          cpu := canonify_cpu(cpu_orig)
          max_cpu_orig := input.parameters.requests_cpu
          max_cpu := canonify_cpu(max_cpu_orig)
          cpu > max_cpu
          msg := sprintf("container <%v> cpu request <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.jobTemplate.spec.template.spec.containers[_]
          mem_orig := container.resources.requests.memory
          mem := canonify_mem(mem_orig)
          max_mem_orig := input.parameters.requests_memory
          max_mem := canonify_mem(max_mem_orig)
          mem > max_mem
          msg := sprintf("container <%v> memory request <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])
        }


        #####################################################################################################################
        # spec.containers
        #####################################################################################################################

        #### limits


        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          cpu_orig := container.resources.limits.cpu
          not canonify_cpu(cpu_orig)
          msg := sprintf("container <%v> cpu limit <%v> could not be parsed", [container.name, cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          mem_orig := container.resources.limits.memory
          not canonify_mem(mem_orig)
          msg := sprintf("container <%v> memory limit <%v> could not be parsed", [container.name, mem_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources
          msg := sprintf("container <%v> has no resources", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.limits
          msg := sprintf("container <%v> has no resource limits", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          missing(container.resources.limits, "cpu")
          msg := sprintf("container <%v> has no cpu limit", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          missing(container.resources.limits, "memory")
          msg := sprintf("container <%v> has no memory limit", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          cpu_orig := container.resources.limits.cpu
          cpu := canonify_cpu(cpu_orig)
          max_cpu_orig := input.parameters.limits_cpu
          max_cpu := canonify_cpu(max_cpu_orig)
          cpu > max_cpu
          msg := sprintf("container <%v> cpu limit <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          mem_orig := container.resources.limits.memory
          mem := canonify_mem(mem_orig)
          max_mem_orig := input.parameters.limits_memory
          max_mem := canonify_mem(max_mem_orig)
          mem > max_mem
          msg := sprintf("container <%v> memory limit <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])
        }


        #### requests

      
        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          cpu_orig := container.resources.requests.cpu
          not canonify_cpu(cpu_orig)
          msg := sprintf("container <%v> cpu request <%v> could not be parsed", [container.name, cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          mem_orig := container.resources.requests.memory
          not canonify_mem(mem_orig)
          msg := sprintf("container <%v> memory request <%v> could not be parsed", [container.name, mem_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources
          msg := sprintf("container <%v> has no resources", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          not container.resources.requests
          msg := sprintf("container <%v> has no resource requests", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          missing(container.resources.requests, "cpu")
          msg := sprintf("container <%v> has no cpu request", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          missing(container.resources.requests, "memory")
          msg := sprintf("container <%v> has no memory request", [container.name])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          cpu_orig := container.resources.requests.cpu
          cpu := canonify_cpu(cpu_orig)
          max_cpu_orig := input.parameters.requests_cpu
          max_cpu := canonify_cpu(max_cpu_orig)
          cpu > max_cpu
          msg := sprintf("container <%v> cpu request <%v> is higher than the maximum allowed of <%v>", [container.name, cpu_orig, max_cpu_orig])
        }

        violation[{"msg": msg}] {
          container := input.review.object.spec.containers[_]
          mem_orig := container.resources.requests.memory
          mem := canonify_mem(mem_orig)
          max_mem_orig := input.parameters.requests_memory
          max_mem := canonify_mem(max_mem_orig)
          mem > max_mem
          msg := sprintf("container <%v> memory request <%v> is higher than the maximum allowed of <%v>", [container.name, mem_orig, max_mem_orig])
        }