Added check for cpu resources which are template params (#74)

redhat-cop · Jul 10, 2020 · 7bc36e8 · 7bc36e8
1 parent 726e987
commit 7bc36e8
Show file tree

Hide file tree

Showing 3 changed files with 10 additions and 4 deletions.
diff --git a/_test/warn-k8s_ocp-deployment_deploymentconfig-bestpractices/list-Deployment.yml b/_test/warn-k8s_ocp-deployment_deploymentconfig-bestpractices/list-Deployment.yml
@@ -1360,6 +1360,6 @@ items:
             resources:
               requests:
                 memory: ${PARAM}
-                cpu: 1
+                cpu: ${PARAM}
               limits:
                 memory: ${PARAM}
diff --git a/_test/warn-k8s_ocp-deployment_deploymentconfig-bestpractices/list-DeploymentConfig.yml b/_test/warn-k8s_ocp-deployment_deploymentconfig-bestpractices/list-DeploymentConfig.yml
@@ -1416,7 +1416,7 @@ items:
             resources:
               requests:
                 memory: ${PARAM}
-                cpu: 1
+                cpu: ${PARAM}
               limits:
                 memory: ${PARAM}
     triggers:

diff --git a/policy/warn-k8s_ocp-deployment_deploymentconfig-bestpractices.rego b/policy/warn-k8s_ocp-deployment_deploymentconfig-bestpractices.rego
@@ -110,11 +110,17 @@ warn[msg] {
 
   container := input.spec.template.spec.containers[_]
 
+  not isResourceCpuRequestsContainsDollar with input as container
   not isResourceCpuRequestsUnitsValid with input as container
 
   msg := sprintf("%s/%s container '%s' cpu resources for requests (%s) has an incorrect unit. See: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#resource-units-in-kubernetes", [input.kind, input.metadata.name, container.name, container.resources.requests.cpu])
 }
 
+isResourceCpuRequestsContainsDollar {
+  not isResourceCpuRequestsAnCore
+  startswith(input.resources.requests.cpu, "$")
+}
+
 isResourceCpuRequestsAnCore {
   is_number(input.resources.requests.cpu)
   to_number(input.resources.requests.cpu)
@@ -128,10 +134,10 @@ isResourceCpuRequestsUnitsValid {
   not isResourceCpuRequestsAnCore
 
   # 'cpu' can be a quoted number, which is why we concat an empty string[] to match whole cpu cores
-  cpuLimitsUnit := array.concat(regex.find_n("[A-Za-z]+", input.resources.requests.cpu, 1), [""])[0]
+  cpuRequestsUnit := array.concat(regex.find_n("[A-Za-z]+", input.resources.requests.cpu, 1), [""])[0]
 
   units := ["m", ""]
-  cpuLimitsUnit == units[_]
+  cpuRequestsUnit == units[_]
 }
 
 warn[msg] {