diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml index 1272b1885ca..6a307478c51 100644 --- a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml +++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/kustomization.yaml @@ -4,4 +4,3 @@ kind: Kustomization resources: - schematic-to-pod.yaml - ensure-digest.yaml - - safe-to-evict.yaml diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml deleted file mode 100644 index 2436aea6e2b..00000000000 --- a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/safe-to-evict.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: add-safe-to-evict - annotations: - policies.kyverno.io/title: Add Safe To Evict - policies.kyverno.io/category: Other - policies.kyverno.io/subject: Pod,Annotation - policies.kyverno.io/minversion: 1.6.0 - policies.kyverno.io/description: >- - The Kubernetes cluster autoscaler does not evict pods that - use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation - cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods. -spec: - rules: - - name: annotate-empty-dir - match: - any: - - resources: - kinds: - - Pod - mutate: - patchStrategicMerge: - metadata: - annotations: - +(cluster-autoscaler.kubernetes.io/safe-to-evict): "true" - spec: - volumes: - - <(emptyDir): {} diff --git a/clustertool/pkg/gencmd/bootstrap.go b/clustertool/pkg/gencmd/bootstrap.go index d4920884d35..5d632143a2d 100644 --- a/clustertool/pkg/gencmd/bootstrap.go +++ b/clustertool/pkg/gencmd/bootstrap.go @@ -175,9 +175,19 @@ func RunBootstrap(args []string) { prioCharts := []fluxhandler.HelmChart{ {filepath.Join(helper.ClusterPath, "/kubernetes/system/spegel/app"), false, true}, {filepath.Join(helper.ClusterPath, "/kubernetes/system/cert-manager/app"), false, false}, + {filepath.Join(helper.ClusterPath, "/kubernetes/system/kyverno/app"), false, false}, } fluxhandler.InstallCharts(prioCharts, HelmRepos, false) + kyvernoPolicies := []string{filepath.Join(helper.ClusterPath, "/kubernetes/core/kyverno-policies/app/ensure-digest.yaml"), filepath.Join(helper.ClusterPath, "/kubernetes/core/kyverno-policies/app/schematic-to-pod.yaml")} + + for _, filePath := range kyvernoPolicies { + log.Info().Msgf("Bootstrap: Loading KyvernoPolicies: %v", filePath) + if err := kubectlcmds.KubectlApply(ctx, filePath); err != nil { + log.Info().Msgf("Error applying manifest for %s: %v\n", filepath.Base(filePath), err) + } + } + intermediateCharts := []fluxhandler.HelmChart{ {filepath.Join(helper.ClusterPath, "/kubernetes/system/metallb/app"), false, false}, {filepath.Join(helper.ClusterPath, "/kubernetes/system/cloudnative-pg/app"), false, false}, @@ -191,7 +201,6 @@ func RunBootstrap(args []string) { {filepath.Join(helper.ClusterPath, "/kubernetes/system/longhorn/app"), false, true}, {filepath.Join(helper.ClusterPath, "/kubernetes/system/csi-driver-smb/app"), false, true}, {filepath.Join(helper.ClusterPath, "/kubernetes/system/csi-driver-nfs/app"), false, false}, - {filepath.Join(helper.ClusterPath, "/kubernetes/system/topolvm/app"), false, true}, } fluxhandler.InstallCharts(intermediateCharts, HelmRepos, true) @@ -228,7 +237,6 @@ func RunBootstrap(args []string) { log.Info().Msg("Bootstrap: Installing included applications") postCharts := []fluxhandler.HelmChart{ {filepath.Join(helper.ClusterPath, "/kubernetes/apps/kubernetes-dashboard/app"), false, true}, - // TODO: Add Intel GPU CRD to truecharts and reference here } fluxhandler.InstallCharts(postCharts, HelmRepos, true)