fix(query): Extend memory_limits_not_defined k8s rule to cover further resource kinds

assets/queries/k8s/memory_limits_not_defined/metadata.json

@@ -3,7 +3,7 @@
   "queryName": "Memory Limits Not Defined",
   "severity": "MEDIUM",
   "category": "Resource Management",
-  "descriptionText": "Memory limits should be specified",
+  "descriptionText": "Memory limits should be defined for each container. This prevents potential resource exhaustion by ensuring that containers consume not more than the designated amount of memory",
   "descriptionUrl": "https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/",
   "platform": "Kubernetes",
   "descriptionID": "e0ba95cc"

assets/queries/k8s/memory_limits_not_defined/query.rego

@@ -1,63 +1,26 @@
 package Cx
 
 import data.generic.common as common_lib
+import data.generic.k8s as k8sLib
 
 types := {"initContainers", "containers"}
 
 CxPolicy[result] {
 	document := input.document[i]
-	spec := document.spec
+	specInfo := k8sLib.getSpecInfo(document)
+	container := specInfo.spec[types[t]][c]
 
-	containers := spec[types[t]][c]
-
-	limits := containers.resources.limits
+	resources := object.get(container, "resources", {})
+	limits := object.get(resources, "limits", {})
 	not common_lib.valid_key(limits, "memory")
 
 	metadata := document.metadata
-
-	result := {
-		"documentId": document.id,
-		"searchKey": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources.limits", [metadata.name, types[t], containers.name]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources.limits.memory is defined", [metadata.name, types[t], containers.name]),
-		"keyActualValue": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources.limits.memory is undefined", [metadata.name, types[t], containers.name]),
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	spec := document.spec
-
-	containers := spec[types[t]][c]
-
-	not common_lib.valid_key(containers, "resources")
-	metadata := document.metadata
-
-	result := {
-		"documentId": document.id,
-		"searchKey": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}", [metadata.name, types[t], containers.name]),
-		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources are defined", [metadata.name, types[t], containers.name]),
-		"keyActualValue": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources are undefined", [metadata.name, types[t], containers.name]),
-	}
-}
-
-CxPolicy[result] {
-	document := input.document[i]
-	spec := document.spec
-
-	containers := spec[types[t]][c]
-
-	resources := containers.resources
-	not common_lib.valid_key(resources, "limits")
-
-	metadata := document.metadata
-
 	result := {
 		"documentId": document.id,
-		"searchKey": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources", [metadata.name, types[t], containers.name]),
+		"searchKey": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}", [metadata.name, specInfo.path, types[t], container.name]),
 		"issueType": "MissingAttribute",
-		"keyExpectedValue": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources.limits are defined", [metadata.name, types[t], containers.name]),
-		"keyActualValue": sprintf("metadata.name={{%s}}.spec.%s.name={{%s}}.resources.limits are undefined", [metadata.name, types[t], containers.name]),
+		"keyExpectedValue": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.resources.limits.memory is defined", [metadata.name, specInfo.path, types[t], container.name]),
+		"keyActualValue": sprintf("metadata.name={{%s}}.%s.%s.name={{%s}}.resources.limits.memory is undefined", [metadata.name, specInfo.path, types[t], container.name]),
+		"searchLine": common_lib.build_search_line(split(specInfo.path, "."), [types[t], c, "resources", "limits"])
 	}
 }

assets/queries/k8s/memory_limits_not_defined/test/negative2.yaml

@@ -0,0 +1,26 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment-neg
+  labels:
+    app: test-neg
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: test-neg
+  template:
+    metadata:
+      labels:
+        app: test-neg
+    spec:
+      containers:
+        - name:  pause
+          image: k8s.gcr.io/pause
+          resources:
+            limits:
+              cpu: 0.5
+              memory: 512Mi
+            requests:
+              cpu: 0.5
+              memory: 512Mi

assets/queries/k8s/memory_limits_not_defined/test/positive2.yaml

@@ -0,0 +1,25 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-deployment
+  labels:
+    app: test
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: test
+  template:
+    metadata:
+      labels:
+        app: test
+    spec:
+      containers:
+        - name:  pause
+          image: k8s.gcr.io/pause
+          resources:
+            limits:
+              cpu: 1
+            requests:
+              cpu: 0.5
+              memory: 512Mi

assets/queries/k8s/memory_limits_not_defined/test/positive_expected_result.json

@@ -2,21 +2,31 @@
   {
     "queryName": "Memory Limits Not Defined",
     "severity": "MEDIUM",
-    "line": 10
+    "line": 8,
+    "fileName": "positive1.yaml"
   },
   {
     "queryName": "Memory Limits Not Defined",
     "severity": "MEDIUM",
-    "line": 25
+    "line": 23,
+    "fileName": "positive1.yaml"
   },
   {
     "queryName": "Memory Limits Not Defined",
     "severity": "MEDIUM",
-    "line": 38
+    "line": 38,
+    "fileName": "positive1.yaml"
   },
   {
     "queryName": "Memory Limits Not Defined",
     "severity": "MEDIUM",
-    "line": 57
+    "line": 57,
+    "fileName": "positive1.yaml"
+  },
+  {
+    "queryName": "Memory Limits Not Defined",
+    "severity": "MEDIUM",
+    "line": 21,
+    "fileName": "positive2.yaml"
   }
 ]