Pods which don't specify at least resource requests are assigned a QoS class of BestEffort which can hog resources for other Pods on Nodes. At a minimum, all Pods should specify resource requests in order to be labeled as the QoS class Burstable. This sample mutates any container in a Pod which doesn't specify memory or cpu requests to apply some sane defaults.
apiVersion: kyverno.io/v1kind: ClusterPolicymetadata:name: add-default-resourcesannotations:policies.kyverno.io/title: Add Default Resourcespolicies.kyverno.io/category: Otherpolicies.kyverno.io/severity: mediumkyverno.io/kyverno-version: 1.10.0-alpha.2policies.kyverno.io/minversion: 1.7.0kyverno.io/kubernetes-version: "1.26"policies.kyverno.io/subject: Podpolicies.kyverno.io/description: Pods which don't specify at least resource requests are assigned a QoS class of BestEffort which can hog resources for other Pods on Nodes. At a minimum, all Pods should specify resource requests in order to be labeled as the QoS class Burstable. This sample mutates any container in a Pod which doesn't specify memory or cpu requests to apply some sane defaults.spec:background: falserules:- name: add-default-requestsmatch:any:- resources:kinds:- Podpreconditions:any:- key: "{{request.operation || 'BACKGROUND'}}"operator: AnyInvalue:- CREATE- UPDATEmutate:foreach:- list: request.object.spec.[ephemeralContainers, initContainers, containers][]patchStrategicMerge:spec:containers:- (name): "{{element.name}}"resources:requests:+(memory): 100Mi+(cpu): 100m
The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
The Kubernetes cluster autoscaler does not evict pods that use hostPath or emptyDir volumes. To allow eviction of these pods, the annotation cluster-autoscaler.kubernetes.io/safe-to-evict=true must be added to the pods.
CAST AI will not downscale a node that includes a pod with the autoscaling.cast.ai/removal-disabled="true" label on it, this protects sensitive workloads from being evicted and can be attributed to any pod to protect against unwanted downscaling. This policy will mutate jobs and cronjobs to add the removal-disabled label to protect against eviction.