-
Notifications
You must be signed in to change notification settings - Fork 1.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Add resource limits to Ansible operator scaffolding #3573
Comments
It is important because common attacks take advantage of it. See; https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-7-limit-resources-memory-cpu-file-descriptors-processes-restarts PS. The default values are not enough for Ansible. So, the complexity here is to find what values should be appropriated. |
Some research is needed to determine what these default values should be. We have deprioritized for now-- please feel free to chime in or open a PR with suggested defaults. |
Issues go stale after 90d of inactivity. Mark the issue as fresh by commenting If this issue is safe to close now please do so with /lifecycle stale |
/lifecycle frozen |
@asmacdo, @fabianvf, @jmrodri shows like we need to be priorized this one. We need to have default values that work for our samples, note that users will be notified that they ought to optimize the values based on their projects. See: https://github.com/operator-framework/operator-sdk/pull/5330/files#diff-063b9bbaede872aca0d6afe93d010d359c86cbc7ad4c1eab8652d8a5a46f6158R50-R51 It was also added in the docs:
https://sdk.operatorframework.io/docs/best-practices/common-recommendation/ And then, see: operator-framework/api#172 |
The Helm operator scaffolds resource limits in the manager manifest:
operator-sdk/internal/plugins/helm/v1/scaffolds/internal/templates/config/manager/manager.go
Lines 78 to 84 in 24d73f7
However these resource limits were too restrictive for ansible operators. Since v0.19 scaffolded Ansible operators do not have resource limits, I am considering this a new feature that can be added post 1.0 release.
The text was updated successfully, but these errors were encountered: