From 5608fa2f0d59230923a1199c2c7c8fc78cfe28c3 Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Wed, 9 Sep 2026 23:21:51 +0200
Subject: [PATCH] kyverno(kube): strip limits.cpu too

---
 .../policy-strip-cpu-requests.yaml              | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
index 94ed35c..17d163b 100644
--- a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
+++ b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
@@ -34,8 +34,11 @@ metadata:
     policies.kyverno.io/severity: low
     policies.kyverno.io/subject: Pod
     policies.kyverno.io/description: >-
-      Removes resources.requests.cpu from pods so they can be scheduled on an
-      overloaded single-node cluster. Toggle via spec.failurePolicy:
+      Removes resources.requests.cpu AND resources.limits.cpu from pods so they
+      can be scheduled on an overloaded single-node cluster. Limits must be
+      stripped too: the LimitRanger admission plugin defaults requests.cpu =
+      limits.cpu whenever a limit exists without a request, so stripping only
+      the request is a no-op. Toggle via spec.failurePolicy:
       Ignore = active (strip), Never = inactive (restore).
 spec:
   # Never block a pod if Kyverno admission is itself under pressure.
@@ -88,9 +91,13 @@ spec:
         # `request.object` is available in BOTH admission and background modes:
         # the backgroundController synthesizes an admission-like request for
         # existing resources, so the same foreach works for both.
-        # NOTE: inside `foreach`, patchStrategicMerge must be an INLINE YAML
+        # NOTE 1: inside `foreach`, patchStrategicMerge must be an INLINE YAML
         # mapping — a `|` block scalar is parsed as a string and fails with
         # "wrong node kind: expected MappingNode but got ScalarNode".
+        # NOTE 2: limits.cpu MUST be stripped together with requests.cpu.
+        # The LimitRanger admission plugin defaults requests.cpu = limits.cpu
+        # whenever a container has a limit but no request, so stripping only
+        # the request is a no-op for any container that declares a limit.
         foreach:
           - list: "request.object.spec.containers"
             patchStrategicMerge:
@@ -100,6 +107,8 @@ spec:
                     resources:
                       requests:
                         cpu: null
+                      limits:
+                        cpu: null
           - list: "request.object.spec.initContainers || `[]`"
             patchStrategicMerge:
               spec:
@@ -108,3 +117,5 @@ spec:
                     resources:
                       requests:
                         cpu: null
+                      limits:
+                        cpu: null