Terminated pod garbage collector threshold not properly set

This product is not supported for your selected Datadog site. ().

Metadata

Id: 49113af4-29ca-458e-b8d4-724c01a4a24f

Cloud Provider: Kubernetes

Platform: Kubernetes

Severity: Medium

Category: Availability

Learn More

Description

For containers running kube-controller-manager, the --terminated-pod-gc-threshold flag must be set to a value between 0 and 12501. The rule checks the command fields in both initContainers and containers and reports when the flag is missing or set to an incorrect value.

Compliant Code Examples

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager"]
      args: ["--terminated-pod-gc-threshold=10"]
  restartPolicy: OnFailure

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager","--terminated-pod-gc-threshold=10"]
      args: []
  restartPolicy: OnFailure

Non-Compliant Code Examples

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager"]
      args: ["--terminated-pod-gc-threshold=12501"]
  restartPolicy: OnFailure

apiVersion: v1
kind: Pod
metadata:
  name: command-demo
  labels:
    purpose: demonstrate-command
spec:
  containers:
    - name: command-demo-container
      image: gcr.io/google_containers/kube-controller-manager-amd64:v1.6.0
      command: ["kube-controller-manager","--terminated-pod-gc-threshold=0"]
      args: []
  restartPolicy: OnFailure