vhaudiquet/homeprod
1
0
Fork 0
mirror of https://github.com/vhaudiquet/homeprod.git synced 2026-09-12 20:21:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

kyverno(kube): strip limits.cpu too

Browse Source
This commit is contained in:
vhaudiquet
2026-09-09 23:21:51 +02:00
parent 3d258f147d
commit 5608fa2f0d
1 changed files with 14 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
+14 -3
View File
@@ -34,8 +34,11 @@ metadata:
policies.kyverno.io/severity: low policies.kyverno.io/severity: low
policies.kyverno.io/subject: Pod policies.kyverno.io/subject: Pod
policies.kyverno.io/description: >- policies.kyverno.io/description: >-
Removes resources.requests.cpu from pods so they can be scheduled on an Removes resources.requests.cpu AND resources.limits.cpu from pods so they
overloaded single-node cluster. Toggle via spec.failurePolicy: can be scheduled on an overloaded single-node cluster. Limits must be
stripped too: the LimitRanger admission plugin defaults requests.cpu =
limits.cpu whenever a limit exists without a request, so stripping only
the request is a no-op. Toggle via spec.failurePolicy:
Ignore = active (strip), Never = inactive (restore). Ignore = active (strip), Never = inactive (restore).
spec: spec:
# Never block a pod if Kyverno admission is itself under pressure. # Never block a pod if Kyverno admission is itself under pressure.
@@ -88,9 +91,13 @@ spec:
# `request.object` is available in BOTH admission and background modes: # `request.object` is available in BOTH admission and background modes:
# the backgroundController synthesizes an admission-like request for # the backgroundController synthesizes an admission-like request for
# existing resources, so the same foreach works for both. # existing resources, so the same foreach works for both.
# NOTE: inside `foreach`, patchStrategicMerge must be an INLINE YAML # NOTE 1: inside `foreach`, patchStrategicMerge must be an INLINE YAML
# mapping — a `|` block scalar is parsed as a string and fails with # mapping — a `|` block scalar is parsed as a string and fails with
# "wrong node kind: expected MappingNode but got ScalarNode". # "wrong node kind: expected MappingNode but got ScalarNode".
# NOTE 2: limits.cpu MUST be stripped together with requests.cpu.
# The LimitRanger admission plugin defaults requests.cpu = limits.cpu
# whenever a container has a limit but no request, so stripping only
# the request is a no-op for any container that declares a limit.
foreach: foreach:
- list: "request.object.spec.containers" - list: "request.object.spec.containers"
patchStrategicMerge: patchStrategicMerge:
@@ -100,6 +107,8 @@ spec:
resources: resources:
requests: requests:
cpu: null cpu: null
limits:
cpu: null
- list: "request.object.spec.initContainers || `[]`" - list: "request.object.spec.initContainers || `[]`"
patchStrategicMerge: patchStrategicMerge:
spec: spec:
@@ -108,3 +117,5 @@ spec:
resources: resources:
requests: requests:
cpu: null cpu: null
limits:
cpu: null