feat: requests and limit policies (#2095)

* chore: save progress

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

* feat: requests and limit policies

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

---------

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

playground/installation/capsule/release.flux.yaml

@@ -111,6 +111,8 @@ spec:
       leaderElection: true
       oidcUsernameClaim: "${OIDC_USERNAME_CLAIM}"
       roleBindingReflector: true
+      ignoredUsernames:
+        - "admin"
       extraArgs:
         - "--feature-gates=ProxyClusterScoped=true"
     service:

playground/installation/headlamp/release.flux.yaml

@@ -10,7 +10,6 @@ spec:
   targetNamespace: capsule-system
   serviceAccountName: kustomize-controller
   dependsOn:
-    - name: capsule
     - name: dex
   chart:
     spec:
@@ -87,12 +86,12 @@ spec:
                 items:
                   - key: ca
                     path: ca.crt
-            - downwardAPI: null
-              items:
-                - fieldRef:
-                    apiVersion: v1
-                    fieldPath: metadata.namespace
-                  path: namespace
+            - downwardAPI:
+                items:
+                  - fieldRef:
+                      apiVersion: v1
+                      fieldPath: metadata.namespace
+                    path: namespace
     initContainers:
       - name: add-ca
         image: docker.io/alpine:3

playground/platform/globalresourcequotas/green-shared-compute.yaml

@@ -11,7 +11,7 @@ spec:
         capsule.clastix.io/tenant: green
   quota:
     hard:
-      limits.cpu: "8"
+      limits.cpu: "0"
       limits.memory: 16Gi
       requests.cpu: "8"
       requests.memory: 16Gi

playground/platform/resourcepools/pool-renewable.yaml

@@ -6,8 +6,8 @@ metadata:
 spec:
   quota:
     hard:
-      limits.cpu: "2"
       limits.memory: 2Gi
+      limits.cpu: "0"
       requests.cpu: "2"
       requests.memory: 2Gi
       requests.storage: "5Gi"

playground/platform/resourcepools/pool-solar.yaml

@@ -8,8 +8,8 @@ metadata:
 spec:
   quota:
     hard:
-      limits.cpu: "2"
       limits.memory: 2Gi
+      limits.cpu: "0"
       requests.cpu: "2"
       requests.memory: 2Gi
       requests.storage: "5Gi"

playground/platform/tenants/green.yaml

@@ -20,6 +20,16 @@ spec:
   - enforce:
       action: allow
       metadata:
+        - apiGroups:
+            - "v1"
+          kinds:
+            - "Namespace"
+          labels:
+            projectcapsule.dev/backup:
+              managed: "true"
+          annotations:
+            storagelocationtype:
+              managed: "s3"
         - kinds:
             - Pod
           annotations:

playground/platform/tenants/wind.yaml

@@ -17,16 +17,24 @@ spec:
     - matchLabels:
         team: devops
   rules:
-    - namespaceSelector:
-        matchLabels:
-          company.example/tier: application
-      quota:
+    # Enforce Resource-Allocation to best-practices
+    - quota:
         - name: billable-compute
           hard:
             requests.cpu: "8"
             requests.memory: 16Gi
-            limits.cpu: "8"
+            limits.cpu: "0"
             limits.memory: 16Gi
+            requests.storage: "5Gi"
+      enforce:
+        action: deny
+        workloads:
+          resources:
+            limits:
+              cpu:
+                policy: Remove
+              memory:
+                policy: MatchRequest
     - permissions:
         bindings:
           - clusterRoleName: 'view'

playground/user/workloads/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - statefulset.yaml

playground/user/workloads/statefulset.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: web
+spec:
+  selector:
+    matchLabels:
+      app: nginx # has to match .spec.template.metadata.labels
+  serviceName: "nginx"
+  replicas: 3 # by default is 1
+  minReadySeconds: 10 # by default is 0
+  template:
+    metadata:
+      labels:
+        app: nginx # has to match .spec.selector.matchLabels
+    spec:
+      terminationGracePeriodSeconds: 10
+      resources:
+        requests:
+          cpu: 100m
+      containers:
+      - name: nginx
+        image: registry.k8s.io/nginx-slim:0.24
+        ports:
+        - containerPort: 80
+          name: web
+        volumeMounts:
+        - name: www
+          mountPath: /usr/share/nginx/html
+  volumeClaimTemplates:
+    - metadata:
+        name: www
+      spec:
+        accessModes:
+          - "ReadWriteOnce"
+        resources:
+          requests:
+            storage: 1Gi