No CPU request or memory limit specified

{
  "id": "886c3c94-3a6a-4f2b-82fc-d6bf5a310840",
  "name": "No CPU request or memory limit specified",
  "description": "Alert on deployments that have containers without CPU request or memory limit",
  "rationale": "A container without a specified CPU request may be starved for CPU time, while a container without a specified memory limit may cause the host to become over-provisioned.",
  "remediation": "Specify CPU request and memory limit for your deployment.",
  "severity": "medium",
  "categories": [
    "DevOps Best Practices",
    "Docker CIS"
  ],
  "lifecycle": [
    "deploy"
  ],
  "eventSource": "none",
  "scope": [],
  "exclusions": [
    {
      "name": "Don't alert on system namespaces",
      "namespace": "^kube.*|^openshift.*|^redhat.*|^istio-system$"
    },
    {
      "name": "Don't alert on management-infra namespace",
      "namespace": "management-infra"
    },
    {
      "name": "application-manager",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "cert-policy-controller",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "cluster-manager",
      "namespace": "multicluster-engine"
    },
    {
      "name": "cluster-manager-placement-controller",
      "namespace": "open-cluster-management-hub"
    },
    {
      "name": "cluster-manager-registration-controller",
      "namespace": "open-cluster-management-hub"
    },
    {
      "name": "cluster-manager-registration-webhook",
      "namespace": "open-cluster-management-hub"
    },
    {
      "name": "cluster-manager-work-webhook",
      "namespace": "open-cluster-management-hub"
    },
    {
      "name": "cluster-proxy",
      "namespace": "multicluster-engine"
    },
    {
      "name": "cluster-proxy-addon-manager",
      "namespace": "multicluster-engine"
    },
    {
      "name": "cluster-proxy-addon-user",
      "namespace": "multicluster-engine"
    },
    {
      "name": "cluster-proxy-proxy-agent",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "cluster-proxy-service-proxy",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "config-policy-controller",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "console-chart-console-v2",
      "namespace": "open-cluster-management"
    },
    {
      "name": "console-mce-console",
      "namespace": "multicluster-engine"
    },
    {
      "name": "governance-policy-framework",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "grc-policy-addon-controller",
      "namespace": "open-cluster-management"
    },
    {
      "name": "grc-policy-propagator",
      "namespace": "open-cluster-management"
    },
    {
      "name": "hive-clustersync",
      "namespace": "hive"
    },
    {
      "name": "hive-controllers",
      "namespace": "hive"
    },
    {
      "name": "hive-operator",
      "namespace": "multicluster-engine"
    },
    {
      "name": "hiveadmission",
      "namespace": "hive"
    },
    {
      "name": "iam-policy-controller",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "infrastructure-operator",
      "namespace": "multicluster-engine"
    },
    {
      "name": "insights-client",
      "namespace": "open-cluster-management"
    },
    {
      "name": "insights-metrics",
      "namespace": "open-cluster-management"
    },
    {
      "name": "klusterlet-addon-search",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "klusterlet-addon-workmgr",
      "namespace": "open-cluster-management-agent-addon"
    },
    {
      "name": "klusterlet-registration-agent",
      "namespace": "open-cluster-management-agent"
    },
    {
      "name": "klusterlet-work-agent",
      "namespace": "open-cluster-management-agent"
    },
    {
      "name": "ocm-controller",
      "namespace": "multicluster-engine"
    },
    {
      "name": "ocm-proxyserver",
      "namespace": "multicluster-engine"
    },
    {
      "name": "ocm-webhook",
      "namespace": "multicluster-engine"
    },
    {
      "name": "search-api",
      "namespace": "open-cluster-management"
    },
    {
      "name": "search-collector",
      "namespace": "open-cluster-management"
    },
    {
      "name": "search-indexer",
      "namespace": "open-cluster-management"
    },
    {
      "name": "search-postgres",
      "namespace": "open-cluster-management"
    },
    {
      "name": "submariner-addon",
      "namespace": "open-cluster-management"
    },
    {
      "name": "volsync-addon-controller",
      "namespace": "open-cluster-management"
    }
  ],
  "enforcement": {
    "failBuild": false
  },
  "expression": {
    "op": "or",
    "children": [
      {
        "op": "criterion",
        "field": "container-cpu-request",
        "values": [
          "0.000000"
        ],
        "valuesOp": "or",
        "negate": false
      },
      {
        "op": "criterion",
        "field": "container-memory-limit",
        "values": [
          "0.000000"
        ],
        "valuesOp": "or",
        "negate": false
      }
    ]
  },
  "disabled": false
}

{
  "id": "886c3c94-3a6a-4f2b-82fc-d6bf5a310840",
  "name": "No CPU request or memory limit specified",
  "description": "Alert on deployments that have containers without CPU request or memory limit",
  "rationale": "A container without a specified CPU request may be starved for CPU time, while a container without a specified memory limit may cause the host to become over-provisioned.",
  "remediation": "Specify CPU request and memory limit for your deployment.",
  "disabled": false,
  "categories": [
    "DevOps Best Practices",
    "Docker CIS"
  ],
  "lifecycleStages": [
    "DEPLOY"
  ],
  "eventSource": "NOT_APPLICABLE",
  "exclusions": [
    {
      "name": "Don't alert on system namespaces",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "^kube.*|^openshift.*|^redhat.*|^istio-system$",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on management-infra namespace",
      "deployment": {
        "name": "",
        "scope": {
          "cluster": "",
          "namespace": "management-infra",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment application-manager in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "application-manager",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cert-policy-controller in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "cert-policy-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-manager in namespace multicluster-engine",
      "deployment": {
        "name": "cluster-manager",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-manager-placement-controller in namespace open-cluster-management-hub",
      "deployment": {
        "name": "cluster-manager-placement-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-hub",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-manager-registration-controller in namespace open-cluster-management-hub",
      "deployment": {
        "name": "cluster-manager-registration-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-hub",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-manager-registration-webhook in namespace open-cluster-management-hub",
      "deployment": {
        "name": "cluster-manager-registration-webhook",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-hub",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-manager-work-webhook in namespace open-cluster-management-hub",
      "deployment": {
        "name": "cluster-manager-work-webhook",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-hub",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-proxy in namespace multicluster-engine",
      "deployment": {
        "name": "cluster-proxy",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-proxy-addon-manager in namespace multicluster-engine",
      "deployment": {
        "name": "cluster-proxy-addon-manager",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-proxy-addon-user in namespace multicluster-engine",
      "deployment": {
        "name": "cluster-proxy-addon-user",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-proxy-proxy-agent in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "cluster-proxy-proxy-agent",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment cluster-proxy-service-proxy in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "cluster-proxy-service-proxy",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment config-policy-controller in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "config-policy-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment console-chart-console-v2 in namespace open-cluster-management",
      "deployment": {
        "name": "console-chart-console-v2",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment console-mce-console in namespace multicluster-engine",
      "deployment": {
        "name": "console-mce-console",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment governance-policy-framework in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "governance-policy-framework",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment grc-policy-addon-controller in namespace open-cluster-management",
      "deployment": {
        "name": "grc-policy-addon-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment grc-policy-propagator in namespace open-cluster-management",
      "deployment": {
        "name": "grc-policy-propagator",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment hive-clustersync in namespace hive",
      "deployment": {
        "name": "hive-clustersync",
        "scope": {
          "cluster": "",
          "namespace": "hive",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment hive-controllers in namespace hive",
      "deployment": {
        "name": "hive-controllers",
        "scope": {
          "cluster": "",
          "namespace": "hive",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment hive-operator in namespace multicluster-engine",
      "deployment": {
        "name": "hive-operator",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment hiveadmission in namespace hive",
      "deployment": {
        "name": "hiveadmission",
        "scope": {
          "cluster": "",
          "namespace": "hive",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment iam-policy-controller in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "iam-policy-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment infrastructure-operator in namespace multicluster-engine",
      "deployment": {
        "name": "infrastructure-operator",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment insights-client in namespace open-cluster-management",
      "deployment": {
        "name": "insights-client",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment insights-metrics in namespace open-cluster-management",
      "deployment": {
        "name": "insights-metrics",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment klusterlet-addon-search in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "klusterlet-addon-search",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment klusterlet-addon-workmgr in namespace open-cluster-management-agent-addon",
      "deployment": {
        "name": "klusterlet-addon-workmgr",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent-addon",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment klusterlet-registration-agent in namespace open-cluster-management-agent",
      "deployment": {
        "name": "klusterlet-registration-agent",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment klusterlet-work-agent in namespace open-cluster-management-agent",
      "deployment": {
        "name": "klusterlet-work-agent",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management-agent",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ocm-controller in namespace multicluster-engine",
      "deployment": {
        "name": "ocm-controller",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ocm-proxyserver in namespace multicluster-engine",
      "deployment": {
        "name": "ocm-proxyserver",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment ocm-webhook in namespace multicluster-engine",
      "deployment": {
        "name": "ocm-webhook",
        "scope": {
          "cluster": "",
          "namespace": "multicluster-engine",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment search-api in namespace open-cluster-management",
      "deployment": {
        "name": "search-api",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment search-collector in namespace open-cluster-management",
      "deployment": {
        "name": "search-collector",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment search-indexer in namespace open-cluster-management",
      "deployment": {
        "name": "search-indexer",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment search-postgres in namespace open-cluster-management",
      "deployment": {
        "name": "search-postgres",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment submariner-addon in namespace open-cluster-management",
      "deployment": {
        "name": "submariner-addon",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    },
    {
      "name": "Don't alert on deployment volsync-addon-controller in namespace open-cluster-management",
      "deployment": {
        "name": "volsync-addon-controller",
        "scope": {
          "cluster": "",
          "namespace": "open-cluster-management",
          "label": null
        }
      },
      "image": null
    }
  ],
  "scope": [],
  "severity": "MEDIUM_SEVERITY",
  "enforcementActions": [],
  "policySections": [
    {
      "sectionName": "",
      "policyGroups": [
        {
          "fieldName": "Container CPU Request",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "0.000000"
            }
          ]
        }
      ]
    },
    {
      "sectionName": "",
      "policyGroups": [
        {
          "fieldName": "Container Memory Limit",
          "booleanOperator": "OR",
          "negate": false,
          "values": [
            {
              "value": "0.000000"
            }
          ]
        }
      ]
    }
  ],
  "notifiers": [],
  "lastUpdated": null,
  "SORTName": "",
  "SORTLifecycleStage": "",
  "SORTEnforcement": false,
  "policyVersion": "1.1",
  "mitreAttackVectors": [],
  "criteriaLocked": true,
  "mitreVectorsLocked": true,
  "isDefault": true,
  "source": "IMPERATIVE"
}