How would you audit a cluster or repo of manifests for accidental decimal memory units (e.g., `M`/`G` instead of `Mi`/`Gi`)?
Quick Answer
Grep live specs (`kubectl get pods -A -o yaml | grep -i memory`) and source manifests for memory values ending in a bare `M`/`G` with no `i`. Then enforce it going forward with an admission policy (Kyverno/OPA Gatekeeper) or a CI lint that rejects decimal memory units.
Detailed Answer
A one-off audit and a permanent guardrail are both worth having.
Audit: dump specs and search for the decimal pattern. A regex like memory:\s*"?[0-9]+[MGT]([^i]|$) catches values that use a plain SI suffix. Do this across running pods (-o yaml) and against your Helm charts / kustomize bases in Git.
Prevent: add an admission policy so the mistake can never reach the cluster again. A Kyverno validate rule (or OPA Gatekeeper constraint) can require that every container memory request/limit matches a binary-unit pattern, failing the admission otherwise. Wire the same check into CI (conftest, kubeconform + a policy) so PRs are blocked pre-merge.
Code Example
# Quick audit of running pods kubectl get pods -A -o yaml | grep -iE "memory: *\"?[0-9]+[MGT]([^i]|$)" # Kyverno policy (excerpt) — require binary memory units # validate: # pattern: # spec: # containers: # - resources: # limits: # memory: "?*i" # must end in Ki/Mi/Gi/Ti
Interview Tip
Pair a detection step with a prevention step (policy-as-code) — showing you close the loop is what separates senior answers.