Always Set Resource Requests and Limits

This rule applies to files matching the patterns above.

# Always Set Resource Requests and Limits

## Rule
Every container MUST define resource requests for CPU and memory. Memory limits MUST be set. CPU limits SHOULD be set in multi-tenant clusters.

## Format
```yaml
resources:
  requests:
    memory: "<amount>"
    cpu: "<amount>"
  limits:
    memory: "<amount>"
```

## Good Examples
```yaml
# Web API
resources:
  requests:
    memory: "256Mi"
    cpu: "250m"
  limits:
    memory: "512Mi"

# Worker/background job
resources:
  requests:
    memory: "512Mi"
    cpu: "500m"
  limits:
    memory: "1Gi"

# Database sidecar
resources:
  requests:
    memory: "64Mi"
    cpu: "50m"
  limits:
    memory: "128Mi"
```

## Bad Examples
```yaml
# BAD: No resources at all (BestEffort QoS — first to be evicted)
containers:
  - name: api
    image: myapi:1.0

# BAD: Limits without requests (requests default to limits — overcommits)
resources:
  limits:
    memory: "2Gi"
    cpu: "2"

# BAD: Requests much higher than actual usage (wastes cluster capacity)
resources:
  requests:
    memory: "4Gi"    # App only uses 200Mi
    cpu: "2"         # App only uses 100m
```

## Enforcement
- Use LimitRange to set defaults for pods without explicit resources
- Use ResourceQuota to cap total namespace consumption
- Configure OPA Gatekeeper or Kyverno to reject pods without resource specs
- Enable the `LimitRanger` admission controller (enabled by default)