{"record":{"id":"8239d141b5e578b0","repo":"containerd/containerd","slug":"resource-is-unreasonably-small-1kbit","errorCode":null,"errorMessage":"resource is unreasonably small (< 1kbit)","messagePattern":"resource is unreasonably small \\(< 1kbit\\)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cri/bandwidth/utils.go","lineNumber":47,"sourceCode":"See the License for the specific language governing permissions and\nlimitations under the License.\n*/\n\n// Package bandwidth provides utilities for bandwidth shaping\npackage bandwidth\n\nimport (\n\t\"fmt\"\n\n\t\"k8s.io/apimachinery/pkg/api/resource\"\n)\n\nvar minRsrc = resource.MustParse(\"1k\")\nvar maxRsrc = resource.MustParse(\"1P\")\n\nfunc validateBandwidthIsReasonable(rsrc *resource.Quantity) error {\n\tif rsrc.Value() < minRsrc.Value() {\n\t\treturn fmt.Errorf(\"resource is unreasonably small (< 1kbit)\")\n\t}\n\tif rsrc.Value() > maxRsrc.Value() {\n\t\treturn fmt.Errorf(\"resource is unreasonably large (> 1Pbit)\")\n\t}\n\treturn nil\n}\n\n// ExtractPodBandwidthResources extracts the ingress and egress from the given pod annotations\nfunc ExtractPodBandwidthResources(podAnnotations map[string]string) (ingress, egress *resource.Quantity, err error) {\n\tif podAnnotations == nil {\n\t\treturn nil, nil, nil\n\t}\n\tstr, found := podAnnotations[\"kubernetes.io/ingress-bandwidth\"]\n\tif found {\n\t\tingressValue, err := resource.ParseQuantity(str)\n\t\tif err != nil {\n\t\t\treturn nil, nil, err\n\t\t}","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/containerd/containerd/blob/4246446a2bf7d03837b0244118d858799393bd80/internal/cri/bandwidth/utils.go#L29-L65","documentation":"Kata/CRI bandwidth annotation validation (inherited from kubernetes pkg/util/bandwidth) rejects a bandwidth resource quantity smaller than 1k (1000 bits per second) because TC shaping with such a tiny rate is meaningless. The check runs when extracting ingress/egress values from pod annotations.","triggerScenarios":"A pod annotation like kubernetes.io/ingress-bandwidth or kubernetes.io/egress-bandwidth is set to a quantity whose value() is below minRsrc = resource.MustParse(\"1k\") (e.g. \"100\" or \"1b\").","commonSituations":"Typo in bandwidth annotation units (e.g. \"100\" instead of \"100M\"), testing with tiny values, copying annotations with stripped unit suffixes.","solutions":["Set the annotation to a value >= 1k, e.g. \"1M\" or \"10M\".","Use proper unit suffixes (k/M/G) in the bandwidth annotations.","Remove the bandwidth annotation if throttling is not actually needed."],"exampleFix":"// before\nannotations:\n  kubernetes.io/ingress-bandwidth: \"100\"\n// after\nannotations:\n  kubernetes.io/ingress-bandwidth: \"100M\"","handlingStrategy":"validation","validationCode":"func validBandwidth(v string) bool {\n    q, err := resource.ParseQuantity(v)\n    if err != nil { return false }\n    min := resource.MustParse(\"1k\")\n    max := resource.MustParse(\"1P\")\n    return q.Value() >= min.Value() && q.Value() <= max.Value()\n}\n// use: if !validBandwidth(pod.Annotations[\"kubernetes.io/ingress-bandwidth\"]) { reject pod / drop annotation }","typeGuard":"func isReasonableBandwidth(q *resource.Quantity) bool {\n    return q != nil && q.Value() >= resource.MustParse(\"1k\").Value() && q.Value() <= resource.MustParse(\"1P\").Value()\n}","tryCatchPattern":null,"preventionTips":["Always include unit suffixes (k/M/G) in bandwidth annotations.","Add admission-webhook or lint checks for bandwidth annotation ranges (1k..1P).","Never write bare integers into bandwidth annotations.","Document valid ranges in your platform's pod annotation guidelines."],"tags":["bandwidth","validation","annotations","cri"],"backgroundTag":"invalid-resource-quantity","analyzedSha":"4246446a2bf7d03837b0244118d858799393bd80","analyzedAt":"2026-09-02T00:14:43.053Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T06:17:21.866Z"}