Enhance Resource Constraints Validation Policy to Include InitContainers & EphermalContainers

[nikhilmaheshwari24]

Signed-off-by: nikhilmaheshwari24 [email protected]

Related issue

kyverno/policies#951

Proposed Changes

This PR updates the existing Kyverno policy to validate CPU and memory resource requests and limits for both containers and initContainers within Pods. This enhancement ensures comprehensive resource management across all container types in a Kubernetes cluster.

Checklist

• I have read the contributing guidelines.
• I have inspected the website preview for accuracy.
• I have signed off on my issue.

[nikhilmaheshwari24]

Hi, @realshuting

Please review & help with your approval. TIA

[realshuting]

What about ephemeralContainers?

[nikhilmaheshwari24]

PR Updated ✅ @realshuting

[realshuting]

/lgtm

[realshuting]

Is #951 relevant?

[nikhilmaheshwari24]

My bad. I have updated the comment.

[welcome]

Congratulations! 🎉

Great job merging your first Pull Request here! How awesome! If you are new to this project, feel free to join our Slack community.

[chipzoller]

@realshuting, @nikhilmaheshwari24: changes should not have been made here as these Markdown files are rendered from the contents of the policy library (kyverno/policies). We run a rendering program to then convert to Markdown. These changes will be wiped unless the corresponding policies in the library are updated.

[chipzoller]

The changes made are also incorrect as without conditionals it will cause all Pods to fail if they don't have initContainers or ephemeralContainers.

[nikhilmaheshwari24]

changes should not have been made here as these Markdown files are rendered from the contents of the policy library (kyverno/policies). We run a rendering program to then convert to Markdown. These changes will be wiped unless the corresponding policies in the library are updated.

@chipzoller,

• Should I revert the PR changes and raise a new PR in kyverno/policies to update the corresponding policy in the library?
• Or should I fix the changes here as well and raise a new PR in kyverno/policies to update the corresponding policy in the library?

Policy Path - https://github.com/kyverno/policies/blob/main/best-practices/require-pod-requests-limits/require-pod-requests-limits.yaml

[chipzoller]

I'd just open the PR on kyverno/policies. We'll render policies for the website and pick up those changes.

[nikhilmaheshwari24]

If you haven't raised the PR, let me do it, I want to contribute.

[realshuting]

@realshuting, @nikhilmaheshwari24: changes should not have been made here as these Markdown files are rendered from the contents of the policy library (kyverno/policies). We run a rendering program to then convert to Markdown. These changes will be wiped unless the corresponding policies in the library are updated.

I was not aware of that, thanks for pointing it out.

@nikhilmaheshwari24 - let's open a PR in kyverno/policies with the revised policy, thanks.

[nikhilmaheshwari24]

@realshuting - PR kyverno/policies#1103