[Feature] Add Karpenter Do Not Disrupt policy for Karpenter 1.x migra…

…tion This policy adds the karpenter.sh/do-not-disrupt label to pods that have the deprecated karpenter.sh/do-not-evict label to ensure smooth upgrades from Karpenter 0.x to 1.x versions. Fixes kyverno#1191 Signed-off-by: Indrranil Pawar <[email protected]>
Indrranil · Dec 17, 2024 · 8a579db · 8a579db
1 parent ebc3671
commit 8a579db
Show file tree

Hide file tree

Showing 2 changed files with 68 additions and 0 deletions.
diff --git a/karpenter/add-karpenter-donot-disrupt/add-karpenter-donot-disrupt.yaml b/karpenter/add-karpenter-donot-disrupt/add-karpenter-donot-disrupt.yaml
@@ -0,0 +1,35 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-karpenter-donot-disrupt
+  annotations:
+    policies.kyverno.io/title: Add Karpenter Do Not Disrupt
+    policies.kyverno.io/category: Karpenter, EKS Best Practices
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+    kyverno.io/kyverno-version: 1.7.1
+    policies.kyverno.io/minversion: 1.6.0
+    kyverno.io/kubernetes-version: "1.23"
+    policies.kyverno.io/description: >-
+      This policy assists in migrating from Karpenter 0.x to 1.x by adding the
+      karpenter.sh/do-not-disrupt label to pods that have the deprecated
+      karpenter.sh/do-not-evict label. This ensures smooth upgrades and
+      maintains the intended protection against pod disruption.
+spec:
+  rules:
+    - name: add-donot-disrupt-label
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      preconditions:
+        all:
+          - key: '{{request.object.metadata.labels."karpenter.sh/do-not-evict"}}'
+            operator: Equals
+            value: "true"
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            labels:
+              "karpenter.sh/do-not-disrupt": "true"
diff --git a/karpenter/add-karpenter-donot-disrupt/artifacthub-pkg.yml b/karpenter/add-karpenter-donot-disrupt/artifacthub-pkg.yml
@@ -0,0 +1,33 @@
+name: add-karpenter-donot-disrupt
+version: 1.0.0
+displayName: Add Karpenter Do Not Disrupt Label
+createdAt: "2024-12-17T00:00:00Z"
+description: |
+  This policy assists in migrating from Karpenter 0.x to 1.x by adding the
+  karpenter.sh/do-not-disrupt label to pods that have the deprecated
+  karpenter.sh/do-not-evict label. This ensures smooth upgrades and
+  maintains the intended protection against pod disruption during Karpenter
+  node termination.
+install: |
+  ```sh
+  kubectl apply -f https://raw.githubusercontent.com/kyverno/policies/main/karpenter/add-karpenter-donot-disrupt/add-karpenter-donot-disrupt.yaml
+  ```
+keywords:
+  - kyverno
+  - karpenter
+readme: |
+  # Add Karpenter Do Not Disrupt Label
+
+  This policy facilitates the migration from Karpenter 0.x to 1.x by automatically
+  adding the new karpenter.sh/do-not-disrupt label to pods that use the deprecated
+  karpenter.sh/do-not-evict label.
+
+  When a pod is created with the old karpenter.sh/do-not-evict label, this policy
+  automatically adds the new karpenter.sh/do-not-disrupt label to ensure the pod
+  remains protected during node termination operations in Karpenter 1.x.
+
+  Reference for this change: https://karpenter.sh/v1.0/upgrading/v1beta1-migration/
+annotations:
+  kyverno.io/category: Pod
+  kyverno.io/kubernetes-version: "1.23"
+  kyverno.io/subject: "Pod, Migration"