rego opa 策略检查是否为在 kubernetes 中的部署提供了资源

Question

我正在使用 OPA rego 代码检查部署 kubernetes 中是否提供了 key resources.limits。下面是代码，我正在尝试获取 resources.limits 键，它总是返回 TRUE。无论是否提供资源。

    package resourcelimits

    violation[{"msg": msg}] {
    some container; input.request.object.spec.template.spec.containers[container]
    not container.resources.limits.memory
    msg := "Resources for the pod needs to be provided"

Answer 1

你可以试试这样的：

import future.keywords.in

violation[{"msg": msg}] {
    input.request.kind.kind == "Deployment"

    some container in input.request.object.spec.template.spec.containers
    not container.resources.limits.memory
    msg := sprintf("Container '%v/%v' does not have memory limits", [input.request.object.metadata.name, container.name])
}