diff --git a/charts/kubeflow/dip/cluster-policy.yaml b/charts/kubeflow/dip/cluster-policy.yaml index 0a5ae28..1e6c775 100644 --- a/charts/kubeflow/dip/cluster-policy.yaml +++ b/charts/kubeflow/dip/cluster-policy.yaml @@ -84,3 +84,57 @@ spec: name: generate-notebook-spark-authpolicy skipBackgroundRequests: true validationFailureAction: Audit +--- +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: annotate-kubeflow-profile-ns +spec: + admission: true + background: true + emitWarning: false + rules: + - match: + all: + - resources: + kinds: + - Namespace + selector: + matchLabels: + app.kubernetes.io/part-of: kubeflow-profile + mutate: + patchStrategicMerge: + metadata: + labels: + app.kubernetes.io/paasup-project: '{{ split(request.object.metadata.name,''-'')[0] }}' + name: add-project-annotation + skipBackgroundRequests: true + validationFailureAction: Audit +--- +apiVersion: kyverno.io/v1 +kind: ClusterPolicy +metadata: + name: modify-notebook-for-gpu +spec: + admission: true + background: false + emitWarning: false + rules: + - match: + resources: + kinds: + - Notebook + mutate: + patchStrategicMerge: + spec: + template: + spec: + +(runtimeClassName): nvidia + name: Run gpu pods using nvidia container runtime + preconditions: + any: + - key: '{{ request.object.spec.template.spec.containers[0].resources.limits."nvidia.com/gpu" || '''' }}' + operator: GreaterThan + value: 0 + skipBackgroundRequests: true + validationFailureAction: Audit \ No newline at end of file diff --git a/charts/kubeflow/dip/cluster-role.yaml b/charts/kubeflow/dip/cluster-role.yaml index aedbb34..ceb5aa0 100644 --- a/charts/kubeflow/dip/cluster-role.yaml +++ b/charts/kubeflow/dip/cluster-role.yaml @@ -12,3 +12,6 @@ rules: - apiGroups: ["security.istio.io"] resources: ["authorizationpolicies"] verbs: ["create", "update", "delete", "get", "list", "watch"] + - apiGroups: ["kubeflow.org"] + resources: ["notebooks", "notebooks/status", "notebooks/finalizers"] + verbs: ["create", "update", "delete", "get", "list", "watch"] \ No newline at end of file