Why I am getting AKS security recomendation even I have definied in deployment YAML: Container CPU and memory limits should be enforced

Mohammad Ajmal Yazdani 391

I am running a deployment in AKS cluster and below is my YAML where I have clearly defined cpu/memory request and limit. Question is why I am getting AKS security recommendation : Container CPU and memory limits should be enforced ?

apiVersion: apps/v1
kind: Deployment
metadata:
name: azure-vote-back
namespace: my-dev
spec:
replicas: 1
selector:
matchLabels:
app: azure-vote-back
template:
metadata:
labels:
app: azure-vote-back
spec:
containers:
- name: azure-vote-back
image: redis
resources:
requests:
cpu: 125m
memory: 256Mi
limits:
cpu: 100m
memory: 128Mi
ports:
- containerPort: 6379
name: redis

SRIJIT-BOSE-MSFT 4,336 Reputation points Microsoft Employee

2021-08-23T01:29:32.34+00:00

@Mohammad Ajmal Yazdani , Thank you for your question.

I can see that spec.template.spec.containers[0].resources.requests values are greater than those of spec.template.spec.containers[0].resources.requests. The requests must be less or equal to the limits. Can you please reset the values accordingly and check if it helps?

Container CPU and memory limits should be enforced:

Enforcing CPU and memory limits prevents resource exhaustion attacks (a form of denial of service attack).
We recommend setting limits for containers to ensure the runtime prevents the container from using more than the configured resource limit.

(Related policy: Ensure container CPU and memory resource limits do not exceed the specified limits in Kubernetes cluster)

Severity: Medium
Mohammad Ajmal Yazdani 391 Reputation points

2021-08-23T05:23:49.98+00:00

Thanks @SRIJIT-BOSE-MSFT for pointing out that request must be less or equal to limits. I tried that, but still security recommendation persists. Is there anything else I need to do?

One more question, till what time I need to wait to check whether recommendation applied or not? 15 minutes? Can I change this?

My updated YAML,

apiVersion: apps/v1
kind: Deployment
metadata:
name: azure-vote-back
namespace: my-dev
spec:
replicas: 1
selector:
matchLabels:
app: azure-vote-back
template:
metadata:
labels:
app: azure-vote-back
annotations:
container.apparmor.security.beta.kubernetes.io/azure-vote-back: runtime/default
spec:
containers:
- name: azure-vote-back
image: redis
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 100m
memory: 128Mi
ports:
- containerPort: 6379
name: redis
securityContext:
privileged: false
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
runAsNonRoot: true
runAsUser: 1000
SRIJIT-BOSE-MSFT 4,336 Reputation points Microsoft Employee

2021-08-23T07:56:22.923+00:00

@ IamCoder-6455 , Thank you for your response.

On the Azure Portal please navigate to Azure Policy Assignments and then to the assignment for the Policy Container CPU and memory limits should be enforced. Check the Parameter value for Max allowed CPU units and Max allowed memory bytes in the Parameters section. If the values are lower than the spec.template.spec.containers[0].resources.requests mentioned in the Deployment/Pod manifest you can either Edit Assignment on the Azure Portal to update the Parameter values or set the spec.template.spec.containers[0].resources.requests values in the Deployment/Pod manifest to lower than the Policy Assignment Parameters values and check again.

Please do let us know if the issue still persists.
Mohammad Ajmal Yazdani 391 Reputation points

2021-08-23T11:45:14.23+00:00

Do I need to configure like this?

My YAML definition is,

resources:
requests:
cpu: 50m
memory: 64Mi
limits:
cpu: 100m
memory: 128Mi

And I have configured like below (greater than Limits),

Memory = 256
CPU = 100

]1
Mohammad Ajmal Yazdani 391 Reputation points

2021-08-23T13:40:46.56+00:00

@SRIJIT-BOSE-MSFT . With my above settings, still I can see issue persists.
SRIJIT-BOSE-MSFT 4,336 Reputation points Microsoft Employee

2021-08-23T13:57:14.12+00:00

@Mohammad Ajmal Yazdani , Thank you for your response.

Based on the information available the best course of action would be to open a Microsoft Technical Support request on this issue.

Also, once you get the issue fixed, request you to reply back here on the thread with the resolution steps for the benefit of the community

Accepted answer

Mohammad Ajmal Yazdani 391 Reputation points

2021-08-25T04:08:34.317+00:00

@Mohammad Ajmal Yazdani . Thanks for the help. I was missing unit while updating Policy Assignment Parameters values . This is the correct way to do it and we need to pass unit as well (Mi or Gi for memory & m for cpu) and it's should be greater than or equal to YAML definition.
Please sign in to rate this answer.
Nishikant raj 1 Reputation point

2024-09-13T16:32:48.7166667+00:00

Can you please share the steps what you did yo fix the issue if i don’t have azure policy setup
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Why I am getting AKS security recomendation even I have definied in deployment YAML: Container CPU and memory limits should be enforced

Container CPU and memory limits should be enforced:

0 additional answers

Your answer