Control: Namespaces should have default CPU request in limitRange policy

powerpipe control run kubernetes_compliance.control.namespace_limit_range_default_cpu_request

powerpipe login
powerpipe control run kubernetes_compliance.control.namespace_limit_range_default_cpu_request --share

with default_limit_range as (
  select
    namespace,
    l -> 'default' as default_limit,
    l -> 'defaultRequest' as default_request
  from
    kubernetes_limit_range,
    jsonb_array_elements(spec_limits) as l
)
select
  coalesce(n.uid, concat(n.path, ':', n.start_line)) as resource,
  case
    when default_request ->> 'cpu' is null then 'alarm'
    else 'ok'
  end as status,
  case
    when default_request ->> 'cpu' is null then n.name || ' do not have LimitRange default CPU request.'
    else n.name || ' has LimitRange default CPU request.'
  end as reason
  
  , coalesce(n.context_name, '') as context_name, n.name, n.source_type, coalesce(n.path || ':' || n.start_line || '-' || n.end_line, '') as path
from
  kubernetes_namespace n
  left join default_limit_range r
  on n.name = r.namespace;