diff --git a/best-practices/require-pod-requests-limits/artifacthub-pkg.yml b/best-practices/require-pod-requests-limits/artifacthub-pkg.yml index d5dec6926..c09dc9d67 100644 --- a/best-practices/require-pod-requests-limits/artifacthub-pkg.yml +++ b/best-practices/require-pod-requests-limits/artifacthub-pkg.yml @@ -19,4 +19,4 @@ readme: | annotations: kyverno/category: "Best Practices, EKS Best Practices" kyverno/subject: "Pod" -digest: 6fba669ac94197333cb28249ab01deb6461cc6f909645b721fe66bef78d674ec +digest: bc2fa8b9aed1893274a8bc60abd34fdbe5fbc25d032b7be74214cc1496b77ce1 diff --git a/best-practices/require-pod-requests-limits/require-pod-requests-limits.yaml b/best-practices/require-pod-requests-limits/require-pod-requests-limits.yaml index 652e46f85..b36c4b8de 100644 --- a/best-practices/require-pod-requests-limits/require-pod-requests-limits.yaml +++ b/best-practices/require-pod-requests-limits/require-pod-requests-limits.yaml @@ -16,7 +16,7 @@ metadata: This policy validates that all containers have something specified for memory and CPU requests and memory limits. spec: - validationFailureAction: audit + validationFailureAction: Audit background: true rules: - name: validate-resources @@ -26,10 +26,24 @@ spec: kinds: - Pod validate: - message: "CPU and memory resource requests and limits are required." + message: "CPU and memory resource requests and memory limits are required for containers." pattern: spec: containers: + - resources: + requests: + memory: "?*" + cpu: "?*" + limits: + memory: "?*" + =(initContainers): + - resources: + requests: + memory: "?*" + cpu: "?*" + limits: + memory: "?*" + =(ephemeralContainers): - resources: requests: memory: "?*"