2

I have built a self-service platform based on Kubernetes, where we create namespaces for each team and allow them to 'do whatever they want within the namespace' (we set resource limits so no one can kill the whole cluster).

However, now I want to implement some kind of standard across the organization. For example, I want every PodSpec to define its own resource limits, and I want every resource to have a label that specifies what application it belongs to.

Is there a mechanism that will allow the API server to check the manifests being applied against a set of rules, and if it fails the check the manifest is rejected.

For example, the following manifest would be rejected because it has neither a label nor are resource limits set.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80

But the following manifest would succeed because it satisfies all the rules:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  labels:
    app: foobar
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.7.9
        ports:
        - containerPort: 80
        resources:
          limits:
            cpu: "1"
          requests:
            cpu: "0.5"
  • Why not using RBAC? – 030 Nov 11 '19 at 21:47
  • As far as I know RBAC limits what resources you can interact with and what actions you can perform on those resources. I am not sure it is able to perform validation on whether the manifest has a specified field (like metadata.labels.app, for example) – dayuloli Nov 11 '19 at 21:52
  • And what about writing a custom resource? – 030 Nov 11 '19 at 22:42
  • Have you thought about creating resource quotas per namespace instead? kubernetes.io/docs/concepts/policy/resource-quotas/… – kaizenCoder Nov 12 '19 at 3:10
  • @kaizenCoder have you considered posting your comment as an answer, it's perfectly valid - expand it a little to include a basic summary of the link. This question would benefit from multiple answers as there are many ways to solve this problem. – Richard Slater Nov 12 '19 at 9:35
1

I would be inclined to implement the Open Policy Agent as this will give you the ability to define a policy similar to this:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sContainerLimits
metadata:
  name: container-must-have-limits
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    cpu: "200m"
    memory: "1Gi"

OPA will enforce any policy you defined via an Admission Controller, beware though it's very powerful and I have bricked clusters by not thinking through the options carefully.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.