QoSWatch - Kubernetes missing requests/limits reporter

id: qoswatch
namespace: company.team
description: Reports pods missing CPU/memory requests or limits, naming exactly
  what each one lacks. Read-only by design.

labels:
  project: qoswatch
  team: platform

inputs:
  - id: namespace
    type: STRING
    displayName: "Namespace"
    description: the namespace whose pods to audit
    defaults: default
  - id: slack_webhook
    type: STRING
    displayName: "Slack Webhook URL"
    description: Incoming webhook URL of the Slack channel for the report

triggers:
  - id: schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: audits resource requests and limits every morning
    cron: "0 8 * * *"
    timezone: UTC
    inputs:
      namespace: default
      slack_webhook: "{{ secret('SLACK_WEBHOOK') }}"

tasks:
  - id: list_pods
    type: io.kestra.plugin.scripts.shell.Commands
    description: lists all pods in the namespace as JSON
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
      user: "0"
    containerImage: bitnami/kubectl
    inputFiles:
      client.crt: "{{ secret('CLIENT_CRT') }}"
      client.key: "{{ secret('CLIENT_KEY') }}"
    commands:
      - kubectl get pods -n {{ inputs.namespace }} -o json
        --client-certificate=client.crt --client-key=client.key --server={{
        secret('MASTERURL') }} --insecure-skip-tls-verify=true > pods.json
    outputFiles:
      - pods.json

  - id: find_unlimited
    type: io.kestra.plugin.scripts.python.Script
    description: finds pods missing requests or limits and names the gaps
    taskRunner:
      type: io.kestra.plugin.scripts.runner.docker.Docker
      user: "0"
    containerImage: python:3.11
    dependencies:
      - kestra
    inputFiles:
      pods.json: "{{ outputs.list_pods.outputFiles['pods.json'] }}"
    script: |
      import json
      from kestra import Kestra

      namespace = """{{ inputs.namespace }}"""

      with open('pods.json') as f:
          pods = json.load(f)['items']

      # pod names we already reported, from the KV store (null on first run -> empty)
      raw_state = """{{ kv('qoswatch-state-' ~ inputs.namespace, errorOnMissing=false) }}"""
      already = set(json.loads(raw_state) if raw_state.strip() else [])

      def gaps(container):
          res = container.get('resources', {}) or {}
          req = res.get('requests', {}) or {}
          lim = res.get('limits', {}) or {}
          missing = []
          if 'cpu' not in req:
              missing.append('cpu request')
          if 'memory' not in req:
              missing.append('memory request')
          if 'cpu' not in lim:
              missing.append('cpu limit')
          if 'memory' not in lim:
              missing.append('memory limit')
          return missing

      offenders = []
      for pod in pods:
          meta = pod.get('metadata', {})
          spec = pod.get('spec', {})
          name = meta['name']
          # skip completed/succeeded pods, only running workloads matter here
          if pod.get('status', {}).get('phase') not in ('Running', 'Pending'):
              continue
          pod_gaps = []
          for c in (spec.get('containers', []) or []) + (spec.get('initContainers', []) or []):
              missing = gaps(c)
              if missing:
                  pod_gaps.append(f"{c['name']}: missing {', '.join(missing)}")
          if pod_gaps:
              qos = 'BestEffort' if all('missing' in g and 'request' in g and 'limit' in g for g in pod_gaps) else 'Burstable'
              offenders.append({'pod': name, 'qos': qos, 'gaps': pod_gaps})

      offender_names = sorted(o['pod'] for o in offenders)
      new = [o for o in offenders if o['pod'] not in already]

      lines = [f"*QoSWatch - pods without resource requests/limits in '{namespace}'*", ""]
      for o in new:
          lines.append(f"- *{o['pod']}* ({o['qos']} QoS)")
          for g in o['gaps']:
              lines.append(f"  {g}")
      lines.append("")
      lines.append("these pods get no scheduling guarantees and are first in line for eviction under pressure.")
      alert_text = "\n".join(lines)

      Kestra.outputs({
          'new_offenders': new,
          'count': len(new),
          'alert_text': alert_text,
          'new_state_json': json.dumps(offender_names),
      })

  - id: maybe_alert
    type: io.kestra.plugin.core.flow.If
    description: reports only newly found offenders
    condition: "{{ outputs.find_unlimited.vars.count > 0 }}"
    then:
      - id: send_alert
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: posts the QoS report to Slack
        url: "{{ inputs.slack_webhook }}"
        messageText: "{{ outputs.find_unlimited.vars.alert_text }}"

  - id: save_state
    type: io.kestra.plugin.core.kv.Set
    description: remembers who was reported, so fixed pods drop out quietly
    key: "qoswatch-state-{{ inputs.namespace }}"
    value: "{{ outputs.find_unlimited.vars.new_state_json }}"
    overwrite: true