Memory Requests Not Defined

YAML Configuration

rule.yaml YAML

apiVersion: rules.spotter.dev/v1alpha1
kind: SpotterRule
metadata:
  name: spotter-config-006
  labels:
    severity: "medium"
    category: "config"
  annotations:
    rules.spotter.dev/title: "Memory Requests Not Defined"
    rules.spotter.dev/version: "1.0.0"
    rules.spotter.dev/cwe: "CWE-770"
    rules.spotter.dev/description: "Containers should define memory requests to ensure proper scheduling and resource allocation."
spec:
  match:
    resources:
      kubernetes:
        apiGroups:
          - ""
          - "apps"
          - "batch"
        versions:
          - "v1"
        kinds:
          - Pod
          - Deployment
          - StatefulSet
          - DaemonSet
          - Job
        namespaces:
          include: ["*"]
          exclude: ["kube-system", "kube-public"]
        labels:
          exclude:
            rules.spotter.dev/ignore: ["true"]
  cel: |
    (object.kind == 'Pod' && has(object.spec.containers) && object.spec.containers.exists(c, !has(c.resources) || !has(c.resources.requests) || !has(c.resources.requests.memory))) ||
    (object.kind != 'Pod' && has(object.spec.template.spec.containers) && object.spec.template.spec.containers.exists(c, !has(c.resources) || !has(c.resources.requests) || !has(c.resources.requests.memory)))
  remediation:
    manual: "Set memory requests for all containers in the pod spec."
  references:
    - title: "Managing Resources for Containers"
      url: "https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/"

Test Cases

test-cases.yaml YAML

- name: insecure sample 1 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: memory-demo
      namespace: mem-example
    spec:
      containers:
      - name: memory-demo-ctr-1
        image: polinux/stress
        resources:
          limits:
            memory: "200Mi"
          requests:
            cpu: "0.5"
        command: ["stress"]
        args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]
- name: insecure sample 2 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: memory-demo-1
      namespace: mem-example
    spec:
      containers:
      - name: memory-demo-ctr-2
        image: polinux/stress
        resources:
          limits:
            memory: "200Mi"
        command: ["stress"]
        args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]
- name: insecure sample 3 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: memory-demo-2
      namespace: mem-example
    spec:
      containers:
      - name: memory-demo-ctr-3
        image: polinux/stress
        command: ["stress"]
        args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]
- name: insecure sample 4 should fail
  pass: false
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: memory-demo-3
      namespace: mem-example
    spec:
      securityContext:
        runAsUser: 1000
        runAsGroup: 3000
        fsGroup: 2000
      volumes:
        - name: sec-ctx-vol
          emptyDir: { }
      containers:
      - name: memory-demo-ctr-4
        image: polinux/stress
        command: ["stress"]

- name: insecure sample 5 should fail
  pass: false
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: test-deployment2
      labels:
        app: test2
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: test2
      template:
        metadata:
          labels:
            app: test2
        spec:
          containers:
            - name:  pause
              image: k8s.gcr.io/pause
              resources:
                limits:
                  cpu: 0.5
                  memory: 512Mi

- name: secure sample 1 should pass
  pass: true
  input: |
    apiVersion: v1
    kind: Pod
    metadata:
      name: memory-demo
      namespace: mem-example
    spec:
      containers:
      - name: memory-demo-ctr
        image: polinux/stress
        resources:
          limits:
            memory: "200Mi"
          requests:
            memory: "100Mi"
        command: ["stress"]
        args: ["--vm", "1", "--vm-bytes", "150M", "--vm-hang", "1"]

- name: secure sample 2 should pass
  pass: true
  input: |
    apiVersion: apps/v1
    kind: Deployment
    metadata:
      name: test-deployment-ctr-neg
      labels:
        app: test-neg
    spec:
      replicas: 3
      selector:
        matchLabels:
          app: test-ctr-neg
      template:
        metadata:
          labels:
            app: test-ctr-neg
        spec:
          containers:
            - name:  pause
              image: k8s.gcr.io/pause
              resources:
                limits:
                  cpu: 0.5
                  memory: 512Mi
                requests:
                  cpu: 0.5
                  memory: 512Mi

Validating Admission Policy

validating-admission-policy.yaml YAML

# VAP export for spotter-config-006
# Generated from Spotter rule
apiVersion: admissionregistration.k8s.io/v1beta1
kind: ValidatingAdmissionPolicy
metadata:
  name: spotter-config-006
spec:
  # Add your VAP configuration here

Rule Metadata

Memory Requests Not Defined

YAML Configuration

Test Cases

Validating Admission Policy

Rule Metadata

Rule Information

Tags & Compliance

Compliance Standards

General Tags

Spotter Hub