Skip to content

feat(cluster-policies): require workloads to spread across nodes #1661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
devantler wants to merge 2 commits into
base: main
Choose a base branch
from
+11 −2
Open

feat(cluster-policies): require workloads to spread across nodes #1661

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
95a7c6b
feat(cluster-policies): require workloads to spread across nodes
devantler May 29, 2026
72cb299
Merge branch 'main' into claude/friendly-poincare-67f404
devantler May 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 11 additions & 2 deletions k8s/bases/infrastructure/cluster-policies/kustomization.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -95,7 +95,7 @@ patches:
- op: replace
path: /spec/rules/0/mutate/patchStrategicMerge/spec/template/spec/+(affinity)/+(podAntiAffinity)/+(preferredDuringSchedulingIgnoredDuringExecution)/0/podAffinityTerm/labelSelector/matchExpressions/0/values/0
value: "{{request.object.spec.template.metadata.labels.\"app.kubernetes.io/name\"}}"
# --- Topology spread: remove label gate, add StatefulSet, hostname key, ScheduleAnyway, exclude kube-system ---
# --- Topology spread: remove label gate, add StatefulSet, hostname key, DoNotSchedule, exclude kube-system ---
- target:
kind: ClusterPolicy
name: spread-pods
Expand Down Expand Up @@ -125,7 +125,16 @@ patches:
value: "kubernetes.io/hostname"
- op: replace
path: /spec/rules/0/mutate/patchStrategicMerge/spec/template/spec/+(topologySpreadConstraints)/0/whenUnsatisfiable
value: "ScheduleAnyway"
value: "DoNotSchedule"
# Scope skew per ReplicaSet revision so rolling updates don't deadlock under
# DoNotSchedule (surge pods of the new revision would otherwise count against
# the old revision's skew). Requires k8s >=1.27 (GA in 1.34). For StatefulSets
# the pod-template-hash key is absent, so k8s ignores it and falls back to the
# labelSelector — fine, since StatefulSet updates roll one pod at a time.
- op: add
path: /spec/rules/0/mutate/patchStrategicMerge/spec/template/spec/+(topologySpreadConstraints)/0/matchLabelKeys
value:
- pod-template-hash
- op: replace
path: /spec/rules/0/mutate/patchStrategicMerge/spec/template/spec/+(topologySpreadConstraints)/0/labelSelector
value:
Expand Down
Loading