feat: requests and limit policies (#2095)

* chore: save progress Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> * feat: requests and limit policies Signed-off-by: Oliver Baehler <oliver@sudo-i.net> --------- Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
2026-08-22 22:16:46 +00:00 · 2026-08-21 14:31:06 +02:00
parent 88217e9562
commit 65a4e19e02
57 changed files with 5627 additions and 265 deletions
@@ -5,16 +5,18 @@ package rules

 import (
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/api/resource"

 	"github.com/projectcapsule/capsule/pkg/api/runtime"
 )

-// +kubebuilder:validation:Enum=pod/initcontainers;pod/ephemeralcontainers;pod/containers;pod/volumes
+// +kubebuilder:validation:Enum=pod;pod/initcontainers;pod/ephemeralcontainers;pod/containers;pod/volumes
 type WorkloadValidationTarget string

 const (
 	DeprecatedValidateImages WorkloadValidationTarget = "pod/images"

+	ValidatePod                 WorkloadValidationTarget = "pod"
 	ValidateInitContainers      WorkloadValidationTarget = "pod/initcontainers"
 	ValidateEphemeralContainers WorkloadValidationTarget = "pod/ephemeralcontainers"
 	ValidateContainers          WorkloadValidationTarget = "pod/containers"
@@ -28,6 +30,20 @@ type NamespaceRuleEnforceWorkloadsBody struct {
 	// +optional
 	Targets []WorkloadValidationTarget `json:"targets,omitempty"`

+	// Resources defines mutation and enforcement policies for Pod and container
+	// resource requests and limits. The workload targets select where the
+	// policies apply. With no targets, resource policies apply to all compatible
+	// locations: Pod-level resources, regular containers, and init containers.
+	// Resource names unsupported at Pod level still apply to compatible container
+	// locations.
+	// Mutation is applied when a Pod is created. Remove and MatchRequest manage
+	// explicit values, Default fills an absent value, and Ratio fills an absent
+	// limit from its request. An explicit Ratio violation is then handled by the
+	// enclosing allow, deny, or audit action.
+	//
+	// +optional
+	Resources *WorkloadResourceRules `json:"resources,omitempty"`
+
 	// Define Pod QoS classes matched by this enforcement rule.
 	// Supported values are Guaranteed, Burstable and BestEffort.
 	// +optional
@@ -46,3 +62,70 @@ type NamespaceRuleEnforceWorkloadsBody struct {
 	// +optional
 	Schedulers []runtime.ExpressionMatch `json:"schedulers,omitempty"`
 }
+
+type WorkloadResourceRequestPolicyType string
+
+const (
+	WorkloadResourceRequestPolicyPreserve WorkloadResourceRequestPolicyType = "Preserve"
+	WorkloadResourceRequestPolicyDefault  WorkloadResourceRequestPolicyType = "Default"
+	WorkloadResourceRequestPolicyRemove   WorkloadResourceRequestPolicyType = "Remove"
+)
+
+type WorkloadResourceLimitPolicyType string
+
+const (
+	WorkloadResourceLimitPolicyPreserve     WorkloadResourceLimitPolicyType = "Preserve"
+	WorkloadResourceLimitPolicyDefault      WorkloadResourceLimitPolicyType = "Default"
+	WorkloadResourceLimitPolicyRemove       WorkloadResourceLimitPolicyType = "Remove"
+	WorkloadResourceLimitPolicyMatchRequest WorkloadResourceLimitPolicyType = "MatchRequest"
+	WorkloadResourceLimitPolicyRatio        WorkloadResourceLimitPolicyType = "Ratio"
+)
+
+// WorkloadResourceRules defines policies keyed by Kubernetes resource name.
+//
+// +kubebuilder:object:generate=true
+// +kubebuilder:validation:XValidation:rule="has(self.requests) || has(self.limits)",message="at least one of requests or limits must be set"
+type WorkloadResourceRules struct {
+	// Requests defines policies for resource requests.
+	// +optional
+	// +kubebuilder:validation:MinProperties=1
+	Requests map[corev1.ResourceName]WorkloadResourceRequestPolicy `json:"requests,omitempty"`
+
+	// Limits defines policies for resource limits.
+	// +optional
+	// +kubebuilder:validation:MinProperties=1
+	Limits map[corev1.ResourceName]WorkloadResourceLimitPolicy `json:"limits,omitempty"`
+}
+
+// WorkloadResourceRequestPolicy defines how a resource request is mutated.
+//
+// +kubebuilder:object:generate=true
+// +kubebuilder:validation:XValidation:rule="self.policy == 'Default' ? has(self.value) : !has(self.value)",message="value must be set only for the Default policy"
+type WorkloadResourceRequestPolicy struct {
+	// Policy selects how the request is handled: Preserve leaves it unchanged,
+	// Default fills an absent request, and Remove deletes it.
+	// +kubebuilder:validation:Enum=Preserve;Default;Remove
+	Policy WorkloadResourceRequestPolicyType `json:"policy"`
+
+	// Value is the quantity applied by the Default policy.
+	// +optional
+	Value *resource.Quantity `json:"value,omitempty"`
+}
+
+// WorkloadResourceLimitPolicy defines how a resource limit is mutated and enforced.
+//
+// +kubebuilder:object:generate=true
+// +kubebuilder:validation:XValidation:rule="self.policy == 'Default' || self.policy == 'Ratio' ? has(self.value) : !has(self.value)",message="value must be set only for the Default and Ratio policies"
+type WorkloadResourceLimitPolicy struct {
+	// Policy selects how the limit is handled: Preserve leaves it unchanged,
+	// Default fills an absent limit, Remove deletes it, MatchRequest manages it
+	// to equal the request, and Ratio defaults an absent limit and enforces the
+	// maximum multiplier against explicitly supplied limits.
+	// +kubebuilder:validation:Enum=Preserve;Default;Remove;MatchRequest;Ratio
+	Policy WorkloadResourceLimitPolicyType `json:"policy"`
+
+	// Value is the quantity applied by Default or the maximum limit-to-request
+	// multiplier applied by Ratio.
+	// +optional
+	Value *resource.Quantity `json:"value,omitempty"`
+}
@@ -244,6 +244,11 @@ func (in *NamespaceRuleEnforceWorkloadsBody) DeepCopyInto(out *NamespaceRuleEnfo
 		*out = make([]WorkloadValidationTarget, len(*in))
 		copy(*out, *in)
 	}
+	if in.Resources != nil {
+		in, out := &in.Resources, &out.Resources
+		*out = new(WorkloadResourceRules)
+		(*in).DeepCopyInto(*out)
+	}
 	if in.QoSClasses != nil {
 		in, out := &in.QoSClasses, &out.QoSClasses
 		*out = make([]v1.PodQOSClass, len(*in))
@@ -446,3 +451,72 @@ func (in *ServiceNodePortRule) DeepCopy() *ServiceNodePortRule {
 	in.DeepCopyInto(out)
 	return out
 }
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadResourceLimitPolicy) DeepCopyInto(out *WorkloadResourceLimitPolicy) {
+	*out = *in
+	if in.Value != nil {
+		in, out := &in.Value, &out.Value
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadResourceLimitPolicy.
+func (in *WorkloadResourceLimitPolicy) DeepCopy() *WorkloadResourceLimitPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadResourceLimitPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadResourceRequestPolicy) DeepCopyInto(out *WorkloadResourceRequestPolicy) {
+	*out = *in
+	if in.Value != nil {
+		in, out := &in.Value, &out.Value
+		x := (*in).DeepCopy()
+		*out = &x
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadResourceRequestPolicy.
+func (in *WorkloadResourceRequestPolicy) DeepCopy() *WorkloadResourceRequestPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadResourceRequestPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *WorkloadResourceRules) DeepCopyInto(out *WorkloadResourceRules) {
+	*out = *in
+	if in.Requests != nil {
+		in, out := &in.Requests, &out.Requests
+		*out = make(map[v1.ResourceName]WorkloadResourceRequestPolicy, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+	if in.Limits != nil {
+		in, out := &in.Limits, &out.Limits
+		*out = make(map[v1.ResourceName]WorkloadResourceLimitPolicy, len(*in))
+		for key, val := range *in {
+			(*out)[key] = *val.DeepCopy()
+		}
+	}
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new WorkloadResourceRules.
+func (in *WorkloadResourceRules) DeepCopy() *WorkloadResourceRules {
+	if in == nil {
+		return nil
+	}
+	out := new(WorkloadResourceRules)
+	in.DeepCopyInto(out)
+	return out
+}