All Policies
Set non-CPU limits for pods to work well with Karpenter.
For correct node provisioning Karpenter should know exactly what the non-CPU resources are that the pods will need. Otherwise Karpenter will put as many pods on a node as possible, which may lead to memory pressure on nodes. This is especially important in consolidation mode.
Policy Definition
/karpenter/set-karpenter-non-cpu-limits/set-karpenter-non-cpu-limits.yaml
1apiVersion: kyverno.io/v1
2kind: ClusterPolicy
3metadata:
4 name: set-karpenter-non-cpu-limits
5 annotations:
6 policies.kyverno.io/title: Set non-CPU limits for pods to work well with Karpenter.
7 policies.kyverno.io/subject: Pod
8 policies.kyverno.io/category: Karpenter, EKS Best Practices
9 policies.kyverno.io/severity: medium
10 kyverno.io/kyverno-version: 1.9.3
11 kyverno.io/kubernetes-version: "1.26"
12 policies.kyverno.io/minversion: 1.6.0
13 policies.kyverno.io/description: >-
14 For correct node provisioning Karpenter should know exactly what the non-CPU resources are
15 that the pods will need. Otherwise Karpenter will put as many pods on a node as possible,
16 which may lead to memory pressure on nodes. This is especially important in consolidation
17 mode.
18spec:
19 rules:
20 - name: set-ephemeral-storage
21 match:
22 any:
23 - resources:
24 kinds:
25 - Pod
26 mutate:
27 foreach:
28 - list: request.object.spec.containers
29 patchStrategicMerge:
30 spec:
31 containers:
32 - (name): "{{element.name}}"
33 resources:
34 limits:
35 +(ephemeral-storage): "{{element.resources.limits.\"ephemeral-storage\" || element.resources.requests.\"ephemeral-storage\"}}"
36 requests:
37 ephemeral-storage: "{{element.resources.limits.\"ephemeral-storage\" || element.resources.requests.\"ephemeral-storage\"}}"
38 - name: set-memory
39 match:
40 any:
41 - resources:
42 kinds:
43 - Pod
44 mutate:
45 foreach:
46 - list: request.object.spec.containers
47 patchStrategicMerge:
48 spec:
49 containers:
50 - (name): "{{element.name}}"
51 resources:
52 limits:
53 +(memory): "{{element.resources.limits.memory || element.resources.requests.memory}}"
54 requests:
55 memory: "{{element.resources.limits.memory || element.resources.requests.memory}}"