{{ summaryHeading }}
{{ summaryValue }}
{{ summaryLine }}
{{ badge.label }}{{ badge.value }}
Inspect app, regular init, native sidecar-init, and ephemeral containers without contacting a cluster.
{{ sourceMeta }}
{{ sourceHint }}
The label identifies exports; it does not change resource-policy results.
These are repository-authored review profiles, not a substitute for the namespace's ResourceQuota, LimitRange, or admission policy.
Pod-level budgets never cover ephemeral-storage fields in this checker.
The neutral default leaves optional local-storage policy out of the result.
{{ params.flag_ephemeral_storage ? 'Audit storage requests' : 'CPU and memory only' }}
Use 10–300 rows. The default is 80.
rows
{{ header }}Copy
{{ cell }}
{{ header }}Copy
{{ cell }}
{{ header }}Copy
{{ cell }}
{{ patchText }}
Kubernetes Pod Security Context Checker Check Kubernetes workload YAML for inherited security contexts, Pod Security gaps, weighted findings, and a reviewable hardening patch.
Kubernetes Cluster Capacity Calculator Estimate a rollout-safe Kubernetes replica ceiling from allocatable resources and pod requests, then test node loss and disruption limits.
Kubernetes Deployment Generator Build Kubernetes Deployment YAML with optional Service and policy resources, plus checks for rollout, probes, resources, and security choices.
Environment Variable Inventory Checker Compare required environment variables with ENV, JSON, or YAML inventories and find missing, blank, placeholder, duplicate, or extra entries.

Kubernetes schedules a Pod from declared resource requests, not from the workload's average usage. A missing or undersized CPU or memory request can pack too much work onto a node, while an oversized request can leave usable capacity stranded and keep a Pod pending.

Requests and limits answer different questions. A request reserves scheduler capacity. A limit sets a runtime ceiling or satisfies policy, depending on the resource and cluster configuration. CPU limits can throttle work; memory limits can lead to an out-of-memory termination. Neither value should be chosen merely to make a manifest look complete.

FieldPrimary roleEvidence for sizing
CPU requestScheduler reservation and autoscaling baselineObserved CPU, load tests, or recommendation data
Memory requestScheduler reservation and eviction contextWorking set, startup peaks, and justified headroom
CPU limitOptional or policy-required runtime capPlatform policy and throttling tolerance
Memory limitOut-of-memory boundaryFailure behavior and safe peak memory
Ephemeral storageLocal writable-layer, log, cache, and scratch reservationMeasured local storage growth and eviction risk

Container lifecycle changes the Pod footprint. App containers and native sidecars run together, so their requests add. Regular init containers run sequentially, so the largest init request competes with the concurrent sum rather than adding to it. Pod overhead and any Pod-level request then affect the final placement requirement.

Quality of Service (QoS) is another consequence of resource declarations. A Guaranteed Pod needs positive CPU and memory requests equal to limits for every evaluated container, or an equivalent complete Pod-level budget. Partial declarations become Burstable; no compute requests or limits becomes BestEffort. QoS describes eviction priority and resource treatment, not whether sizing is correct.

Quota, LimitRange, admission policy, and cluster-version support can add further requirements. Pod-level budgets may be accepted on newer clusters, but container-level requests remain the portable review baseline when cluster support or policy is uncertain.

Field coverage is only the first gate. Compare declared resources with live usage, restart history, pending events, replica counts, scaling behavior, and namespace budgets before changing production values.

How to Use This Tool:

Review the rendered manifest that will actually be applied, including all app, init, native sidecar, and ephemeral containers.

  1. Paste YAML or JSON for a Pod or supported workload template. Correct parse errors before using any coverage result.
  2. Select whether the gate requires CPU and memory requests, requests plus memory limits, or quota-ready requests and limits.
  3. Choose how Pod-level CPU and memory budgets affect missing container fields. Require container values for portability, treat Pod budgets as advisory, or accept them as coverage.
  4. Enable the ephemeral-storage audit when writable layers, logs, cache, scratch use, quota, or local-storage eviction matters.
  5. Resolve blockers first, then warnings. Replace every patch placeholder with a value supported by telemetry or policy; the scaffold does not supply safe quantities.

Interpreting Results:

Blockers include required missing fields, invalid quantities, and a limit below its matching request. Review covers warnings such as zero requests, missing policy-dependent limits, or Pod-level evidence retained for manual acceptance. Ready means the selected profile is covered, not that the values are well sized.

Use Scheduler footprint to understand placement, but verify live behavior with metrics and events. The reported footprint is per Pod; replica count is shown separately and is not multiplied into the effective request.

Technical Details:

Kubernetes quantities are normalized before comparison. CPU becomes integer millicores; memory and ephemeral storage become bytes. Binary suffixes such as Mi use powers of two, while decimal suffixes such as M use powers of ten. A malformed or negative quantity is blocking.

Formula Core

For each resource, the effective Pod request takes the largest of the concurrent-container sum, the largest regular init-container request, and the Pod-level request, then adds Pod overhead.

Reffective=max(∑Rconcurrent,Rinit-max,Rpod)+Roverhead

Native sidecar init containers count as concurrent. Regular init containers contribute only their per-resource maximum. Ephemeral containers are excluded because Kubernetes does not allow them to declare resource allocations.

The coverage percentage is the share of evaluated containers with no blocker or warning under the selected review profile.

Coverage=ReadyContainersEvaluatedContainers×100

Rule Core

ConditionResult
Required request missing with no accepted Pod budgetBlocker
Required policy limit missingWarning unless another blocking rule applies
Quantity cannot be normalizedBlocker
Limit is numerically lower than requestBlocker
Explicit request normalizes to zeroWarning
Pod budget exists under advisory modeWarning; cluster support and policy still need review

The source limit is 1 MiB with at most 500 containers. Visible rows can be limited from 10 through 300 without changing counts or verdicts.

Limitations and Privacy Notes:

Manifest analysis runs locally without contacting a cluster. It cannot observe usage, node capacity, admission defaults, quota consumption, or version support. Remove embedded Secrets and unrelated environment data before sharing a report.

Worked Examples:

Concurrent service with a large init step

Two running containers request 250m and 100m CPU, while a regular init container requests 500m. With no Pod-level request or overhead, the effective CPU request is max(350m, 500m, 0) = 500m. Adding the init request to 350m would overstate placement because the regular init container does not run concurrently.

Memory limit below request

A container requesting 512Mi with a 256Mi limit receives a blocker even though both fields are present. The limit must be raised to at least the request or both values must be revised from usage evidence.

References: