# Resource Bounds Dos

> Flag missing resource bounds / DoS resistance — uncapped loops or allocations, missing timeouts, reconciler-wedging input, unbounded metric cardinality (CWE-400, CWE-770).

- Skill: `kubernetes-sigs-kueue/resource-bounds-dos` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kubernetes-sigs-kueue/resource-bounds-dos`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kubernetes-sigs-kueue/resource-bounds-dos/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: Apache-2.0
- Author: kubernetes-sigs (https://skillmd.com/u/kubernetes-sigs-kueue)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/kubernetes-sigs-kueue/resource-bounds-dos

---


# Skill: Resource Bounds / DoS Resistance (CWE-400, CWE-770)

- Loops over user-supplied slices (`PodSets`, `ResourceGroups`, `Flavors`, cohort
  children, admission checks) without a documented webhook-enforced cap or explicit
  length check.
- `make([]T, n)` / `make(map[K]V, n)` where `n` comes from user data without a sanity
  cap.
- Outbound API or HTTP calls without `context.WithTimeout` (or a bounded inherited
  reconcile context).
- Invalid `.spec.interval`-style fields that could wedge the reconciler for the entire
  kind (CVE-2022-39272 pattern). Failures from invalid CR content must surface to
  status, not crash-loop.
- New metrics with unbounded label cardinality — `workload_name`, `pod_name`,
  namespace+name composites, annotation values as labels.