feat: add hpa-maximum-replicas check

docs/generated/checks.md

@@ -269,6 +269,21 @@ forbiddenServiceTypes:
 **Remediation**: Ensure the host's process namespace is not shared.
 
 **Template**: [host-pid](templates.md#host-pid)
+## hpa-maximum-replicas
+
+**Enabled by default**: No
+
+**Description**: Indicates when a HorizontalPodAutoscaler specifies more than the allowed maxReplicas
+
+**Remediation**: Lower the maxReplicas in the HorizontalPodAutoscaler, or raise the check's maxReplicas parameter, so that autoscaling stays within the capacity you intend to allow.
+
+**Template**: [hpa-maximum-replicas](templates.md#horizontalpodautoscaler-maximum-replicas)
+
+**Parameters**:
+
+```yaml
+maxReplicas: 100
+```
 ## hpa-minimum-three-replicas
 
 **Enabled by default**: No

docs/generated/templates.md

@@ -427,6 +427,24 @@ KubeLinter supports the following templates:
 **Supported Objects**: DeploymentLike
 
 
+## HorizontalPodAutoscaler Maximum replicas
+
+**Key**: `hpa-maximum-replicas`
+
+**Description**: Flag applications running more than the specified number of replicas
+
+**Supported Objects**: HorizontalPodAutoscaler
+
+
+**Parameters**:
+
+```yaml
+- description: The maximum number of replicas a HorizontalPodAutoscaler should have
+  name: maxReplicas
+  required: false
+  type: integer
+```
+
 ## HorizontalPodAutoscaler Minimum replicas
 
 **Key**: `hpa-minimum-replicas`

e2etests/bats-tests.sh

@@ -420,6 +420,21 @@ get_value_from() {
   [[ "${count}" == "2" ]]
 }
 
+@test "hpa-maximum-replicas" {
+  tmp="tests/checks/hpa-maximum-replicas.yml"
+  cmd="${KUBE_LINTER_BIN} lint --include hpa-maximum-replicas --do-not-auto-add-defaults --format json ${tmp}"
+  run ${cmd}
+
+  print_info "${status}" "${output}" "${cmd}" "${tmp}"
+  [ "$status" -eq 1 ]
+
+  message1=$(get_value_from "${lines[0]}" '.Reports[0].Object.K8sObject.GroupVersionKind.Kind + ": " + .Reports[0].Diagnostic.Message')
+  count=$(get_value_from "${lines[0]}" '.Reports | length')
+
+  [[ "${message1}" == "HorizontalPodAutoscaler: object has 150 replicas but maximum allowed replicas is 100" ]]
+  [[ "${count}" == "1" ]]
+}
+
 @test "hpa-minimum-three-replicas" {
   tmp="tests/checks/hpa-minimum-three-replicas.yml"
   cmd="${KUBE_LINTER_BIN} lint --include hpa-minimum-three-replicas --do-not-auto-add-defaults --format json ${tmp}"

pkg/builtinchecks/yamls/hpa-maximum-replicas.yaml

@@ -0,0 +1,10 @@
+name: "hpa-maximum-replicas"
+description: "Indicates when a HorizontalPodAutoscaler specifies more than the allowed maxReplicas"
+remediation: >-
+  Lower the maxReplicas in the HorizontalPodAutoscaler, or raise the check's maxReplicas parameter, so that autoscaling stays within the capacity you intend to allow.
+scope:
+  objectKinds:
+    - HorizontalPodAutoscaler
+template: "hpa-maximum-replicas"
+params:
+  maxReplicas: 100

pkg/extract/hpa_spec.go

@@ -35,6 +35,24 @@ func checkReplicas(minReplicas *int32) (int32, bool) {
 	return 1, true
 }
 
+// HPAMaxReplicas extracts maxReplicas from the given object, if available.
+func HPAMaxReplicas(obj k8sutil.Object) (int32, bool) {
+	switch hpa := obj.(type) {
+	case *autoscalingV2Beta1.HorizontalPodAutoscaler:
+		return hpa.Spec.MaxReplicas, true
+	case *autoscalingV2Beta2.HorizontalPodAutoscaler:
+		return hpa.Spec.MaxReplicas, true
+	case *autoscalingV2.HorizontalPodAutoscaler:
+		return hpa.Spec.MaxReplicas, true
+	case *autoscalingV1.HorizontalPodAutoscaler:
+		return hpa.Spec.MaxReplicas, true
+	case *kedaV1Alpha1.ScaledObject:
+		return hpa.GetHPAMaxReplicas(), true
+	default:
+		return 0, false
+	}
+}
+
 // HPAScaleTargetRefName extracts Spec.ScaleTargetRef.Name
 func HPAScaleTargetRefName(obj k8sutil.Object) (string, bool) {
 	switch hpa := obj.(type) {

pkg/templates/all/all.go

@@ -25,6 +25,7 @@ import (
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostmounts"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostnetwork"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hostpid"
+	_ "golang.stackrox.io/kube-linter/pkg/templates/hpamaxreplicas"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/hpareplicas"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/imagepullpolicy"
 	_ "golang.stackrox.io/kube-linter/pkg/templates/jobttlsecondsafterfinished"

pkg/templates/hpamaxreplicas/internal/params/params.go

@@ -0,0 +1,8 @@
+package params
+
+// Params represents the params accepted by this template.
+type Params struct {
+
+	// The maximum number of replicas a HorizontalPodAutoscaler should have
+	MaxReplicas int
+}

pkg/templates/hpamaxreplicas/template.go

@@ -0,0 +1,48 @@
+package hpamaxreplicas
+
+import (
+	"fmt"
+
+	"golang.stackrox.io/kube-linter/internal/stringutils"
+	"golang.stackrox.io/kube-linter/pkg/check"
+	"golang.stackrox.io/kube-linter/pkg/config"
+	"golang.stackrox.io/kube-linter/pkg/diagnostic"
+	"golang.stackrox.io/kube-linter/pkg/extract"
+	"golang.stackrox.io/kube-linter/pkg/lintcontext"
+	"golang.stackrox.io/kube-linter/pkg/objectkinds"
+	"golang.stackrox.io/kube-linter/pkg/templates"
+	"golang.stackrox.io/kube-linter/pkg/templates/hpamaxreplicas/internal/params"
+)
+
+const (
+	templateKey = "hpa-maximum-replicas"
+)
+
+func init() {
+	templates.Register(check.Template{
+		HumanName:   "HorizontalPodAutoscaler Maximum replicas",
+		Key:         templateKey,
+		Description: "Flag applications running more than the specified number of replicas",
+		SupportedObjectKinds: config.ObjectKindsDesc{
+			ObjectKinds: []string{objectkinds.HorizontalPodAutoscaler},
+		},
+		Parameters:             params.ParamDescs,
+		ParseAndValidateParams: params.ParseAndValidate,
+		Instantiate: params.WrapInstantiateFunc(func(p params.Params) (check.Func, error) {
+			return func(_ lintcontext.LintContext, object lintcontext.Object) []diagnostic.Diagnostic {
+				replicas, found := extract.HPAMaxReplicas(object.K8sObject)
+				if !found {
+					return nil
+				}
+				if int(replicas) <= p.MaxReplicas {
+					return nil
+				}
+				return []diagnostic.Diagnostic{
+					{Message: fmt.Sprintf("object has %d %s but maximum allowed replicas is %d",
+						replicas, stringutils.Ternary(replicas > 1, "replicas", "replica"),
+						p.MaxReplicas)},
+				}
+			}, nil
+		}),
+	})
+}

pkg/templates/hpamaxreplicas/template_test.go

@@ -0,0 +1,103 @@
+package hpamaxreplicas
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/suite"
+	"golang.stackrox.io/kube-linter/pkg/diagnostic"
+	"golang.stackrox.io/kube-linter/pkg/lintcontext/mocks"
+	"golang.stackrox.io/kube-linter/pkg/templates"
+	"golang.stackrox.io/kube-linter/pkg/templates/hpamaxreplicas/internal/params"
+	autoscalingV1 "k8s.io/api/autoscaling/v1"
+	autoscalingV2 "k8s.io/api/autoscaling/v2"
+	autoscalingV2Beta1 "k8s.io/api/autoscaling/v2beta1"
+	autoscalingV2Beta2 "k8s.io/api/autoscaling/v2beta2"
+)
+
+var autoscalingVersions = [4]string{"v2beta1", "v2beta2", "v2", "v1"}
+
+func TestHPAMaxReplicas(t *testing.T) {
+	suite.Run(t, new(HPAMaxReplicaTestSuite))
+}
+
+type HPAMaxReplicaTestSuite struct {
+	templates.TemplateTestSuite
+
+	ctx *mocks.MockLintContext
+}
+
+func (s *HPAMaxReplicaTestSuite) SetupTest() {
+	s.Init(templateKey)
+	s.ctx = mocks.NewMockContext()
+}
+
+func (s *HPAMaxReplicaTestSuite) addHPAWithMaxReplicas(name string, replicas int32, version string) {
+	s.ctx.AddMockHorizontalPodAutoscaler(s.T(), name, version)
+	switch version {
+	case "v2beta1":
+		s.ctx.ModifyHorizontalPodAutoscalerV2Beta1(s.T(), name, func(hpa *autoscalingV2Beta1.HorizontalPodAutoscaler) {
+			hpa.Spec.MaxReplicas = replicas
+		})
+	case "v2beta2":
+		s.ctx.ModifyHorizontalPodAutoscalerV2Beta2(s.T(), name, func(hpa *autoscalingV2Beta2.HorizontalPodAutoscaler) {
+			hpa.Spec.MaxReplicas = replicas
+		})
+	case "v2":
+		s.ctx.ModifyHorizontalPodAutoscalerV2(s.T(), name, func(hpa *autoscalingV2.HorizontalPodAutoscaler) {
+			hpa.Spec.MaxReplicas = replicas
+		})
+	case "v1":
+		s.ctx.ModifyHorizontalPodAutoscalerV1(s.T(), name, func(hpa *autoscalingV1.HorizontalPodAutoscaler) {
+			hpa.Spec.MaxReplicas = replicas
+		})
+	default:
+		s.Require().FailNow(fmt.Sprintf("Unknown autoscaling version %s", version))
+	}
+}
+
+func (s *HPAMaxReplicaTestSuite) TestTooManyReplicas() {
+	const (
+		tenReplicasHPAName = "hpa-ten-replicas"
+	)
+
+	for _, version := range autoscalingVersions {
+		s.addHPAWithMaxReplicas(tenReplicasHPAName, 10, version)
+
+		s.Validate(s.ctx, []templates.TestCase{
+			{
+				Param: params.Params{
+					MaxReplicas: 5,
+				},
+				Diagnostics: map[string][]diagnostic.Diagnostic{
+					tenReplicasHPAName: {
+						{Message: "object has 10 replicas but maximum allowed replicas is 5"},
+					},
+				},
+				ExpectInstantiationError: false,
+			},
+		})
+	}
+}
+
+func (s *HPAMaxReplicaTestSuite) TestAcceptableReplicas() {
+	const (
+		acceptableReplicasHPAName = "hpa-acceptable-replicas"
+	)
+
+	for _, version := range autoscalingVersions {
+		s.addHPAWithMaxReplicas(acceptableReplicasHPAName, 5, version)
+
+		s.Validate(s.ctx, []templates.TestCase{
+			{
+				Param: params.Params{
+					MaxReplicas: 5,
+				},
+				Diagnostics: map[string][]diagnostic.Diagnostic{
+					acceptableReplicasHPAName: nil,
+				},
+				ExpectInstantiationError: false,
+			},
+		})
+	}
+}

tests/checks/hpa-maximum-replicas.yml

@@ -0,0 +1,26 @@
+---
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: dont-fire
+spec:
+  minReplicas: 3
+  maxReplicas: 100
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: testing
+  targetCPUUtilizationPercentage: 85
+---
+apiVersion: autoscaling/v2beta1
+kind: HorizontalPodAutoscaler
+metadata:
+  name: app
+spec:
+  minReplicas: 3
+  maxReplicas: 150
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: testing
+  targetCPUUtilizationPercentage: 85