Do not encourage adding CPU limits

[nemobis]

What steps did you take and what happened:

OPA katekeeper appeared on my cluster with AKS defaults. Now I get bunch of logs of the kind:

container has no resource limits

What did you expect to happen:

No encouragement to add CPU limits should be in the default policies.

Anything else you would like to add:

CPU limits are often harmful and should only be added after careful consideration. Kyverno also has stopped encouraging them: kyverno/kyverno#799

Environment:

• Gatekeeper version: mcr.microsoft.com/oss/open-policy-agent/gatekeeper:v3.17.1, sha256:8b4c5d52f6fba917ef23bc3c41613ffd336f8473c444081196030fe08f7f2b64
• Kubernetes version: 1.29

[nemobis]

The example policy was added a while ago: d733e7d

[sozercan]

Agreed on this, we recently removed cpu limits from Gatekeeper deployment too #2326.

However, Azure policies are not directly related to Gatekeeper open-source project. Do you mind creating an issue in https://github.com/azure/aks for tracking Azure policy updates for this?

We can use this issue to track removal in agilebank demo https://github.com/open-policy-agent/gatekeeper/blob/master/demo/agilebank/templates/k8scontainterlimits_template.yaml

[charleswool]

@nemobis Are you using deployment safeguard?

[nemobis]

Agreed on this, we recently removed cpu limits from Gatekeeper deployment too

Good. Speaking of which, CPU requests are too high. 10m would probably be enough; on the busiest nodes I get CPU usage between 10m and 40m.

Do you mind creating an issue in https://github.com/azure/aks for tracking Azure policy updates for this?

I'll think about it but they have dozens of dubious policies and I'm not so interested in contributing to a proprietary Microsoft project. I'm just disabling the "feature" entirely for now.

Are you using deployment safeguard?

Not that I know...