Add Safe To Evict

apiVersion: policies.kyverno.io/v1alpha1
kind: MutatingPolicy
metadata:
  name: add-safe-to-evict
  annotations:
    policies.kyverno.io/title: Add Safe To Evict
    policies.kyverno.io/category: Other
    policies.kyverno.io/subject: Pod,Annotation
    policies.kyverno.io/minversion: 1.6.0
    policies.kyverno.io/description: The Kubernetes cluster autoscaler does not evict pods that  use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation  cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
spec:
  matchConstraints:
    resourceRules:
      - apiGroups:
          - ""
        apiVersions:
          - v1
        operations:
          - CREATE
          - UPDATE
        resources:
          - pods
  matchConditions:
    - name: has-emptydir-or-hostpath
      expression: |
        has(object.spec.volumes) && 
        object.spec.volumes.exists(v, has(v.emptyDir) || has(v.hostPath))
    - name: annotation-not-present
      expression: |
        !has(object.metadata.annotations) || 
        !object.metadata.annotations.exists(k, k == 'cluster-autoscaler.kubernetes.io/safe-to-evict')
  mutations:
    - patchType: ApplyConfiguration
      applyConfiguration:
        expression: |
          Object{
            metadata: Object.metadata{
              annotations: {
                "cluster-autoscaler.kubernetes.io/safe-to-evict": "true"
              }
            }
          }