limits_pods_per_node.rego

# Copyright 2022 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# METADATA
# title: Number of PODs per node
# description: The total number of PODs running on a single node
# custom:
#   group: Scalability
#   severity: Low
#   recommendation: >
#     When the limit is reached, the kube-scheduler will assign the new PODs to the other nodes, if available.
#     If there will be no nodes available to assign the POD, the cluster autoscaler, if configured, may add new nodes.
#     The maximum number of PODs per node is configurable on a cluster and node-pool levels.
#   externalURI: https://cloud.google.com/kubernetes-engine/quotas
#   sccCategory: PODS_PER_NODE_LIMIT
#   dataSource: monitoring, gke
package gke.scalability.pods_per_node

import future.keywords.if
import future.keywords.contains

default valid := false
default threshold := 80

valid if {
	count(violation) == 0
}

violation contains msg if {
	some nodepool, node
	pods_cnt := input.data.monitoring.pods_per_node.vector[nodepool][node]
	pooldata := [object | object := input.data.gke.node_pools[_]; object.name == nodepool]
	limit := pooldata[0].max_pods_constraint.max_pods_per_node
    warn_limit := round(limit * threshold * 0.01)
	pods_cnt > warn_limit
	msg := sprintf("Node %s is running %d PODs and reached warning level of %d (limit is %d)", [node, pods_cnt, warn_limit, limit])
}