Catch Kubernetes Containers Missing Resource Limits — Before You Apply

yq is jq for YAML: it parses a manifest and runs an ordinary jq filter straight against it, no `kubectl get -o json` round trip needed. This flags every container that declares resource requests but no limits, so you catch it in the manifest at review time instead of after a noisy-neighbor incident on the node.

$ curl -s https://raw.githubusercontent.com/kubernetes/website/main/content/en/examples/application/guestbook/frontend-deployment.yaml \
  | yq -r '.spec.template.spec.containers[] | select(.resources.limits == null) | "\(.name): requests=\(.resources.requests // {} | tojson), limits=MISSING"' \
  | sort

1. [01] curlcurl -s <manifest.yaml>
   Fetches the raw Deployment manifest. Swap in any local manifest file, or the output of `kubectl get deploy <name> -o yaml`, to run this against your own cluster or repo.
2. [02] yqyq -r '.spec.template.spec.containers[] | select(.resources.limits == null) | ..…
   Converts the YAML to JSON internally and runs the jq filter directly against it — no separate `-o json` conversion stage — flagging every container whose `resources.limits` is unset.
3. [03] sortsort
   jq/yq already iterate containers in manifest order, but sorting the findings alphabetically by container name keeps a multi-container audit's output stable and diff-friendly across manifest edits.

php-redis: requests={"cpu":"100m","memory":"100Mi"}, limits=MISSING

• Verified with yq (kislyuk/python-yq) 3.1.0 and jq 1.7.1, piping in the official example Deployment from the Kubernetes docs (kubernetes/website), fetched live.
• This is the Python jq-wrapper yq (`pip install yq`, or Debian/Ubuntu's `yq` package) — a different project from the unrelated Go binary mikefarah/yq, which shares the name but not the CLI or flags (no `-o=json`/`-i` here; you just write a jq filter and it runs against the YAML-as-JSON). Check which one `yq --help` on your machine is before scripting against it.
• `.resources.requests // {}` guards containers with no `resources` block at all, so the filter doesn't error out on a bare container spec — it still reports them as `limits=MISSING`.