Update clusterrole for notebook

charts/kubeflow/dip/cluster-policy.yaml

@@ -84,3 +84,57 @@ spec:
       name: generate-notebook-spark-authpolicy
       skipBackgroundRequests: true
   validationFailureAction: Audit
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: annotate-kubeflow-profile-ns
+spec:
+  admission: true
+  background: true
+  emitWarning: false
+  rules:
+  - match:
+      all:
+      - resources:
+          kinds:
+          - Namespace
+          selector:
+            matchLabels:
+              app.kubernetes.io/part-of: kubeflow-profile
+    mutate:
+      patchStrategicMerge:
+        metadata:
+          labels:
+            app.kubernetes.io/paasup-project: '{{ split(request.object.metadata.name,''-'')[0] }}'
+    name: add-project-annotation
+    skipBackgroundRequests: true
+  validationFailureAction: Audit
+---
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: modify-notebook-for-gpu
+spec:
+  admission: true
+  background: false
+  emitWarning: false
+  rules:
+  - match:
+      resources:
+        kinds:
+        - Notebook
+    mutate:
+      patchStrategicMerge:
+        spec:
+          template:
+            spec:
+              +(runtimeClassName): nvidia
+    name: Run gpu pods using nvidia container runtime
+    preconditions:
+      any:
+      - key: '{{ request.object.spec.template.spec.containers[0].resources.limits."nvidia.com/gpu" || '''' }}'
+        operator: GreaterThan
+        value: 0
+    skipBackgroundRequests: true
+  validationFailureAction: Audit

charts/kubeflow/dip/cluster-role.yaml

@@ -12,3 +12,6 @@ rules:
   - apiGroups: ["security.istio.io"]
     resources: ["authorizationpolicies"]
     verbs: ["create", "update", "delete", "get", "list", "watch"]
+  - apiGroups: ["kubeflow.org"]
+    resources: ["notebooks", "notebooks/status", "notebooks/finalizers"]
+    verbs: ["create", "update", "delete", "get", "list", "watch"]