Description of the problem:

I've implemented and tested the LimitRange governance policy in RHACM (policy-limitrange policy.open-cluster-management.io/v1).  The policy template it uses enforces a couple of items that I don't think are practical among real world customers and should be revised.

1. The namespaceSelector excludes 'kube-*' and includes 'default'.  The 'default' namespace in OpenShift 4.x shouldn't have any running pods, but a good best practice is to not apply limitranges to infrastructure projects such as this.  In addition, if this policy were applied to an OpenShift 3.11 cluster, the default namespace will host the registry and router pods, and applying limitranges to router pods is not a best practice as it may impact the cluster infrastructure.  Thus, I think it'd be more practical to exclude infrastructure namespaces and search on all others.

2. The container memory limitranges of 256Mi default request and 512Mi default seemed rather arbitrarily chosen.  It'd be more practical to simply check that those values have been set, rather than check for a particular value.


Release version:

advanced-cluster-management.v2.2.3

Operator snapshot version:

advanced-cluster-management.v2.2.3

OCP version: 4.7.14

Browser Info:

Steps to reproduce:
1. Install Red Hat Advanced Cluster Management operator
2. Add a governance policy for LimitRanges
3. Observe non compliant errors

Actual results:

Governance policy will report non-compliant if a limitrange for the default namespace with container default memory request of 256Mi and default memory of 512Mi is not set, and this is quite restrictive.  A typical cluster admins implementing this policy for the first time is going to have to make quite a number of changes to make it more practical.  Updating the default template policy would help get them started.


Expected results:

My technical suggestion is to replace this existing policy template embedded within the policy:

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-limitrange-container-mem-limit-range
spec:
  remediationAction: inform # will be overridden by remediationAction in parent policy
  severity: medium
  namespaceSelector:
    exclude: ["kube-*"]
    include: ["default"]
  object-templates:
    - complianceType: musthave
      objectDefinition:
        apiVersion: v1
        kind: LimitRange # limit memory usage
        metadata:
          name: container-mem-limit-range
        spec:
          limits:
          - default:
              memory: 512Mi
            defaultRequest:
              memory: 256Mi
            type: Container

With this one (or something like it):

apiVersion: policy.open-cluster-management.io/v1
kind: ConfigurationPolicy
metadata:
  name: policy-limitrange-container-mem-limit-range
spec:
  remediationAction: inform # will be overridden by remediationAction in parent policy
  severity: medium
  namespaceSelector:
    exclude: ["kube-*", "openshift-*", "default", "openshift", "openshift-cluster-management*", "local-cluster"]
    include: ["*"]
  object-templates:
    - complianceType: musthave
      objectDefinition:
        apiVersion: v1
        kind: LimitRange # limit memory usage
        metadata:
          name: container-mem-limit-range
        spec:
          limits:
          - default:
            defaultRequest:
            type: Container