
title: 'Ensure workloads use cluster resource requests and limits'

description: |-
  
  There are two ways to enable resource requests and limits. To create either:

  A multi-project quota, defined by a ClusterResourceQuota object, allows quotas
  to be shared across multiple projects. Resources used in each selected project
  are aggregated and that aggregate is used to limit resources across all the 
  selected projects.

  A resource quota, defined by a ResourceQuota object, provides constraints that
  limit aggregate resource consumption per project. It can limit the quantity of
  objects that can be created in a project by type, as well as the total amount
  of compute resources and storage that might be consumed by resources in that project.

  We want to make sure either a ClusterResourceQuota is used in a cluster or a ResourceQuota
  is used per namespaces.

  <p>
  To configure ClusterResourceQuota, follow the directions in
  {{{ weblink(link="https://docs.openshift.com/container-platform/4.9/applications/quotas/quotas-setting-across-multiple-projects.html",
              text="the documentation") }}}
  </p>

  <p>
  To configure ResourceQuota Per Project, follow the directions in
  {{{ weblink(link="https://docs.openshift.com/container-platform/4.9/applications/quotas/quotas-setting-per-project.html",
              text="the documentation") }}}
  </p>


rationale: |-
  Resource quotas provide constraints that limit aggregate resource consumption 
  per project. This helps prevent resource starvation. When deploying your 
  application, it is important to tune based on memory and CPU consumption, 
  allocating enough resources for the application to function properly.

severity: medium

identifiers:
  cce@ocp4: CCE-90581-0

references:
  nist: SC-5,SC-5(1),SC-5(2)


{{% set jqfilter = '[.items[] | .metadata.name]' %}}

ocil_clause: 'Resource requests and limits is not set'

ocil: |-
  Run the following command to retrieve the ClusterResourceQuota objects in the system:
  <pre>$ oc get clusterquota --all-namespaces </pre>
  Make sure there exists at least one ClusterResourceQuota object in the cluster.


warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/quota.openshift.io/v1/clusterresourcequotas': jqfilter}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: |-
      {{{ openshift_filtered_path('/apis/quota.openshift.io/v1/clusterresourcequotas', jqfilter) }}}
    yamlpath: "[:]"
    entity_check: "at least one"
    values:
      - value: ".*"
        operation: "pattern match"
