Memory limits are not set misconfiguration detected in code

Rule Details

Cortex AppSec Rule ID	APPSEC_K8S_13
Category - Subcategory	Kubernetes - Resource Management
Provider	OTHER
Severity	LOW
Framework	Helm, Kubernetes, Kustomize, Terraform, Terraform Plan

Impact

The scheduler uses resource request information for containers in a pod to decide which node to place the pod on. The kubelet enforces the resource limits set, so that the running container is not allowed to use more resource than the limit set. If a process in the container tries to consume more than the allowed amount of memory, the system kernel terminates the process that attempted the allocation, with an out of memory (OOM) error. With no limit set, kubectl allocates more and more memory to the container until it runs out.

How to Fix

Resource: Container

• Arguments: resources:limits:memory (Optional)

Defines the memory limit for the container. [source,go]

apiVersion: v1 kind: Pod metadata: name: spec: containers:

• name: image: resources: limits:
• memory:

---