CloudWiki
Rules
Medium

Ensure each Container has a configured CPU limit

Availability
No items found.
Description

In a containerized environment, it's important to ensure that each container has a defined CPU limit to prevent any individual container from monopolizing system resources. A container with no CPU limit could potentially consume all available CPU resources on the host, leading to performance issues and potentially affecting the stability of other containers running on the same host. Therefore, it's recommended to ensure that each container has a configured CPU limit.

Remediation

To ensure each container has a configured CPU limit in a Kubernetes environment, follow these remediation steps:

  1. Review the current deployment: Use the kubectl describe deployment <deployment_name> command to view the current deployment configuration. Identify the containers that don't have a CPU limit specified.
  2. Update the deployment manifest: Modify the deployment manifest YAML file to include the CPU limit in the container specification. You can use the following example:

apiVersion: apps/v1
kind: Deployment
metadata:
 name: myapp
spec:
 replicas: 3
 selector:
   matchLabels:
     app: myapp
 template:
   metadata:
     labels:
       app: myapp
   spec:
     containers:
     - name: myapp-container
       image: myapp-image
       resources:
         limits:
           cpu: "1"
         requests:
           cpu: "0.5"


The resources field in the container specification sets the limits for CPU and memory usage. The limits field specifies the maximum amount of CPU that the container can use, while the requests field specifies the minimum amount of CPU that the container needs to run.

      3. Apply the updated configuration: Use the kubectl apply -f <manifest_file> command to apply the updated configuration to the cluster.

      4. Verify the deployment: Use the kubectl describe deployment <deployment_name> command again to verify that the containers now have a CPU limit specified.

      5. Repeat for other deployments: Repeat these steps for each deployment in your Kubernetes environment that doesn't have a CPU limit specified.

Enforced Resources
Note: Remediation steps provided by Lightlytics are meant to be suggestions and guidelines only. It is crucial to thoroughly verify and test any remediation steps before applying them to production environments. Each organization's infrastructure and security needs may differ, and blindly applying suggested remediation steps without proper testing could potentially cause unforeseen issues or vulnerabilities. Therefore, it is strongly recommended that you validate and customize any remediation steps to meet your organization's specific requirements and ensure that they align with your security policies and best practices.