Back to Checks
kubernetes

Container memory requests are configured

core_memory_requests_set
Service: coreSeverity: medium
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are evaluated for containers without memory requests configured in resources.requests.memory, indicating the scheduler cannot guarantee memory allocation.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Without memory requests, the scheduler cannot make informed placement decisions, leading to:

  • Overcommitted nodes that trigger OOM kills (availability)
  • Unpredictable performance under load
  • Inability to enforce ResourceQuotas effectively Missing requests weaken cluster stability and make capacity planning unreliable, increasing blast radius during incidents.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_memory_requests_set

Recommendation

Set memory requests on every container so the scheduler can guarantee memory allocation and place pods effectively.

  • Base requests on observed steady-state usage; use VPA for data-driven sizing
  • Enforce minimum requests via LimitRanges at the namespace level
  • Combine with ResourceQuotas for defense in depth against overcommitment

Remediation

CLI

kubectl set resources deployment/<workload-name> -c <container-name> --requests=memory=<memory-request> -n <namespace>
# Example: kubectl set resources deployment/nginx -c nginx --requests=memory=64Mi -n default

Terraform

resource "kubernetes_pod" "<example_resource_name>" {
  metadata { name = "<example_resource_name>" }
  spec {
    container {
      name  = "<example_resource_name>"
      image = "<IMAGE>"
      resources {
        requests = {
          memory = "64Mi" # Critical: guarantees memory for the scheduler to make informed placement
        }
      }
    }
  }
}

Other

1Open your Kubernetes UI (e.g., cloud provider console or Dashboard)
2Navigate to the failing workload (Deployment/StatefulSet/DaemonSet) or Pod and choose Edit YAML/Manifest
3Set resources.requests.memory for each affected container:
4- For controllers: spec.template.spec.containers[].resources.requests.memory
5- For standalone Pods: spec.containers[].resources.requests.memory
6Save changes (controllers will roll out new Pods). If it is a standalone Pod, delete and recreate it to apply the change

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_memory_requests_set(Check):
    """Ensure that memory requests are set on all containers."""

    def execute(self) -> list[Check_Report_Kubernetes]:
        """Execute the check logic.

        Returns:
            A list of reports containing the result of the check.
        """
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Pod {pod.name} has memory requests set on all containers."
            )

            for container in (pod.containers or {}).values():
                resources = container.resources or {}
                requests = (
                    resources.get("requests") if isinstance(resources, dict) else None
                )
                memory = (
                    requests.get("memory")
                    if requests and isinstance(requests, dict)
                    else None
                )
                if not memory:
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} does not have memory requests set on container {container.name}."
                    break

            findings.append(report)

        return findings

References