apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: generate-notebook-resources
spec:
  admission: true
  background: true
  emitWarning: false
  rules:
    - generate:
        apiVersion: v1
        data:
          metadata:
            labels:
              statefulset: '{{request.object.metadata.name}}'
          spec:
            clusterIP: None
            selector:
              statefulset: '{{request.object.metadata.name}}'
        kind: Service
        name: '{{request.object.metadata.name}}-headless'
        namespace: '{{request.object.metadata.namespace}}'
        synchronize: true
      match:
        resources:
          kinds:
            - Notebook
      name: generate-notebook-headless-service
      skipBackgroundRequests: true
    - generate:
        apiVersion: networking.istio.io/v1alpha3
        data:
          metadata:
            labels:
              statefulset: '{{request.object.metadata.name}}'
          spec:
            hosts:
              - >-
                {{request.object.metadata.name}}-headless.{{request.object.metadata.namespace}}.svc.cluster.local
            http:
              - route:
                  - destination:
                      host: >-
                        {{request.object.metadata.name}}-headless.{{request.object.metadata.namespace}}.svc.cluster.local
                      subset: '{{request.object.metadata.name}}-0'
                    weight: 100
        kind: VirtualService
        name: notebook-{{request.object.metadata.name}}-headless-service
        namespace: '{{request.object.metadata.namespace}}'
        synchronize: true
      match:
        resources:
          kinds:
            - Notebook
      name: generate-notebook-headless-virtualservice
      skipBackgroundRequests: true
    - generate:
        apiVersion: security.istio.io/v1beta1
        data:
          metadata:
            labels:
              statefulset: '{{request.object.metadata.name}}'
          spec:
            rules:
              - from:
                  - source:
                      principals:
                        - >-
                          cluster.local/ns/{{request.object.metadata.namespace}}/sa/default-editor
              - to:
                  - operation:
                      ports: []
            selector:
              matchLabels:
                statefulset: '{{request.object.metadata.name}}'
        kind: AuthorizationPolicy
        name: '{{request.object.metadata.name}}-spark-communication'
        namespace: '{{request.object.metadata.namespace}}'
        synchronize: true
      match:
        resources:
          kinds:
            - Notebook
      name: generate-notebook-spark-authpolicy
      skipBackgroundRequests: true
  validationFailureAction: Audit
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: annotate-kubeflow-profile-ns
spec:
  admission: true
  background: true
  emitWarning: false
  rules:
  - match:
      all:
      - resources:
          kinds:
          - Namespace
          selector:
            matchLabels:
              app.kubernetes.io/part-of: kubeflow-profile
    mutate:
      patchStrategicMerge:
        metadata:
          labels:
            app.kubernetes.io/paasup-project: '{{ split(request.object.metadata.name,''-'')[0] }}'
    name: add-project-annotation
    skipBackgroundRequests: true
  validationFailureAction: Audit
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: modify-notebook-for-gpu
spec:
  admission: true
  background: false
  emitWarning: false
  rules:
  - match:
      resources:
        kinds:
        - Notebook
    mutate:
      patchStrategicMerge:
        spec:
          template:
            spec:
              +(runtimeClassName): nvidia
    name: Run gpu pods using nvidia container runtime
    preconditions:
      any:
      - key: '{{ request.object.spec.template.spec.containers[0].resources.limits."nvidia.com/gpu" || '''' }}'
        operator: GreaterThan
        value: 0
    skipBackgroundRequests: true
  validationFailureAction: Audit