feat: add native nodeselector - #3639
Open
CasLubbers wants to merge 7 commits into
Open
Conversation
CasLubbers
requested review from
Ani1357,
j-zimnowoda and
merll
as code owners
September 11, 2026 08:18
Contributor
|
Comparison of Helm chart templating output: # apl-gitea-operator/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# apl-harbor-operator/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# apl-keycloak-operator/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# apl-operator/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# argocd-image-updater/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# cert-manager/templates/cainjector-deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# cert-manager/templates/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# cert-manager/templates/startupapicheck-job.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# cert-manager/templates/webhook-deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# cert-manager-webhook-linode/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# cloudnative-pg/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# plugin-barman-cloud/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# external-dns/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# external-secrets/templates/cert-controller-deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# external-secrets/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# external-secrets/templates/webhook-deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# git-server/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# gitea/templates/gitea/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# otomi-db/templates/cluster.yaml
@@ spec.affinity @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# valkey/templates/primary/application.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# harbor/templates/core/core-dpl.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# harbor/templates/jobservice/jobservice-dpl.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# harbor/templates/portal/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# harbor/templates/redis/statefulset.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# harbor/templates/registry/registry-dpl.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# harbor/templates/trivy/trivy-sts.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# otomi-db/templates/cluster.yaml
@@ spec.affinity @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# istiod/templates/configmap-values.yaml
@@ data.original-values @@
! ± value change in multiline text (one insert, no deletions)
{
"autoscaleMax": 5,
"autoscaleMin": 1,
"gatewayClasses": {
[91 lines unchanged)]
"probes": 3,
"time": "10s"
}
},
+ "nodeSelector": {
+ "otomi": "otomi-sys"
+ },
"pilot": {
"env": {
"PILOT_DEBOUNCE_MAX": "10s",
"PILOT_ENABLE_ALPHA_GATEWAY_API": "true",
[eleven lines unchanged)]
}
},
"revision": "1-26-0"
}
@@ data.merged-values @@
! ± value change in multiline text (one insert, one deletion)
{
"affinity": {},
"autoscaleBehavior": {},
"autoscaleEnabled": true,
[224 lines unchanged)]
"probes": 3,
"time": "10s"
}
},
- "nodeSelector": {},
+ "nodeSelector": {
+ "otomi": "otomi-sys"
+ },
"ownerName": "",
"pdb": {
"minAvailable": 1,
"unhealthyPodEvictionPolicy": ""
[62 lines unchanged)]
"variant": "",
"volumeMounts": [],
"volumes": []
}
# istiod/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kubernetes-gateways/templates/configmap.yaml
@@ data.deployment @@
# v1/ConfigMap/gateway-platform-options
! ± value change in multiline text (one insert, no deletions)
spec:
replicas: 3
template:
spec:
+ nodeSelector:
+ otomi: otomi-sys
containers:
- name: istio-proxy
resources:
limits:
[one line unchanged)]
memory: 2048Mi
requests:
cpu: 200m
memory: 256Mi
@@ data.deployment @@
# v1/ConfigMap/gateway-knative-local-gateway-options
! ± value change in multiline text (one insert, no deletions)
spec:
replicas: 2
template:
spec:
+ nodeSelector:
+ otomi: otomi-sys
containers:
- name: istio-proxy
resources:
limits:
[one line unchanged)]
memory: 1024Mi
requests:
cpu: 100m
memory: 128Mi
# oauth2-proxy/charts/redis-ha/templates/redis-ha-statefulset.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# oauth2-proxy/charts/redis-ha/templates/tests/test-redis-ha-configmap.yaml
@@ spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# oauth2-proxy/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# keycloakx/templates/statefulset.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# otomi-db/templates/cluster.yaml
@@ spec.affinity @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# raw-cr/templates/resources.yaml
@@ spec.config.features @@
! + one map entry added:
+ podspec-nodeselector: enabled
@@ spec.workloads @@
! + two list entries added:
+ - name: net-gateway-api-controller
+ nodeSelector:
+ otomi: otomi-sys
+ - name: net-gateway-api-webhook
+ nodeSelector:
+ otomi: otomi-sys
@@ spec.workloads.controller @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
@@ spec.workloads.activator @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
@@ spec.workloads.webhook @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
@@ spec.workloads.autoscaler @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
@@ spec.workloads.autoscaler-hpa @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kserve-resources/templates/kserve/resources.yaml
@@ spec.template.spec @@
# apps/v1/Deployment/kserve/kserve-controller-manager
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# metrics-server/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/admission-controller/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# kyverno/templates/background-controller/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# kyverno/templates/cleanup-controller/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# kyverno/templates/hooks/post-upgrade-migrate-resources.yaml
@@ spec.template.spec @@
# batch/v1/Job/kyverno/kyverno-migrate-resources
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/hooks/pre-delete-remove-webhooks.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/hooks/pre-delete-scale-to-zero.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/reports-controller/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# kyverno/templates/tests/admission-controller-metrics.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/tests/cleanup-controller-liveness.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/tests/cleanup-controller-metrics.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/tests/cleanup-controller-readiness.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kyverno/templates/tests/reports-controller-metrics.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# Old file deleted: kyverno-kyverno-artifacts/raw
# loki/templates/compactor/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/distributor/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/gateway/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/index-gateway/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/ingester/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/querier/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/query-frontend/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# loki/templates/query-scheduler/workload.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# prometheus-blackbox-exporter/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# prometheus-msteams/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kube-prometheus-stack/charts/kube-state-metrics/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kube-prometheus-stack/templates/alertmanager/alertmanager.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kube-prometheus-stack/templates/prometheus/prometheus.yaml
@@ spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# kube-prometheus-stack/templates/prometheus-operator/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# opentelemetry-operator/templates/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# opentelemetry-operator/templates/tests/test-certmanager-connection.yaml
@@ spec.nodeSelector @@
! + one map entry added:
+ otomi: otomi-sys
# opentelemetry-operator/templates/tests/test-service-connection.yaml
@@ spec.nodeSelector @@
# v1/Pod/otel/otel-operator-metrics-test
! + one map entry added:
+ otomi: otomi-sys
@@ spec.nodeSelector @@
# v1/Pod/otel/otel-operator-webhook-test
! + one map entry added:
+ otomi: otomi-sys
# otomi-operator/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# otomi-api/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# otomi-console/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# policy-reporter/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# rabbitmq-cluster-operator/templates/cluster-operator/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# rabbitmq-cluster-operator/templates/messaging-topology-operator/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# rabbitmq-cluster-operator/templates/messaging-topology-operator/validating-webhook-configuration.yaml
# sealed-secrets/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# tekton-dashboard/templates/deployment.yaml
@@ spec.template.spec @@
! - one map entry removed:
- nodeSelector:
- kubernetes.io/os: linux
# tekton-dashboard/templates/deployment.yaml
@@ spec.template.spec @@
! - one map entry removed:
- nodeSelector:
- kubernetes.io/os: linux
# tekton-dashboard/templates/deployment.yaml
@@ spec.template.spec.nodeSelector @@
! - one map entry removed:
- kubernetes.io/os: linux
! + one map entry added:
+ otomi: otomi-sys
# tekton-pipeline/templates/config-defaults-cm.yaml
@@ data.default-pod-template @@
! ± value change in multiline text (one insert, no deletions)
priorityClassName: tekton-low
+ nodeSelector:
+ otomi: otomi-sys
+
# tekton-pipeline/templates/tekton-pipelines-controller-deploy.yaml
@@ spec.template.spec.nodeSelector @@
! ± type change from <nil> to map
- <nil>
+ otomi: otomi-sys
# tekton-pipeline/templates/tekton-pipelines-remote-resolvers-deploy.yaml
@@ spec.template.spec.nodeSelector @@
! ± type change from <nil> to map
- <nil>
+ otomi: otomi-sys
# tekton-pipeline/templates/tekton-pipelines-webhook-deploy.yaml
@@ spec.template.spec.nodeSelector @@
! ± type change from <nil> to map
- <nil>
+ otomi: otomi-sys
# tekton-triggers/templates/interceptor/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# tekton-triggers/templates/release/deployments.yaml
@@ spec.template.spec @@
# apps/v1/Deployment/tekton-pipelines/tekton-triggers-controller
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
@@ spec.template.spec @@
# apps/v1/Deployment/tekton-pipelines/tekton-triggers-webhook
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# trivy-operator/templates/configmaps/operator.yaml
@@ data @@
! + one map entry added:
+ scanJob.nodeSelector: "{\"otomi\":\"otomi-sys\"}"
# trivy-operator/templates/deployment.yaml
@@ spec.template.spec @@
! + one map entry added:
+ nodeSelector:
+ otomi: otomi-sys
# values-repo.yaml
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Unresolved moderate findings leave several workloads without native selector propagation.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds native otomi.nodeSelector propagation across platform Helm values and custom charts, replacing the Kyverno mutation policy.
Changes:
- Configures selectors for platform, operator, database, monitoring, and gateway workloads.
- Extends Tekton Triggers, Kubernetes Gateways, and Git Server charts.
- Removes the Kyverno node-selector mutation policy.
The review identified 13 unresolved moderate findings involving incomplete selector propagation and Tekton scheduling scope.
File summaries
| File | Description |
|---|---|
values/trivy-operator/trivy-operator.gotmpl |
Configures operator and server scheduling. Moderate, 3 votes: scanner Jobs lack scanJobNodeSelector. |
values/tekton-triggers/tekton-triggers.gotmpl |
Configures Trigger components. |
values/tekton-pipelines/tekton-pipelines.gotmpl |
Configures Tekton components. Moderate, 3 votes: events controller lacks a selector. Moderate, 1 vote: default pod template broadens selector scope to user workloads. |
values/sealed-secrets/sealed-secrets.gotmpl |
Configures Sealed Secrets scheduling. |
values/rabbitmq/rabbitmq.gotmpl |
Configures RabbitMQ operators. |
values/prometheus-operator/prometheus-operator.gotmpl |
Configures monitoring components. Moderate, 3 votes: admission webhook deployment and Jobs lack selectors. |
values/prometheus-msteams/prometheus-msteams.gotmpl |
Configures Prometheus Teams scheduling. |
values/prometheus-blackbox-exporter/prometheus-blackbox-exporter.gotmpl |
Configures blackbox exporter scheduling. |
values/policy-reporter/policy-reporter.gotmpl |
Configures Policy Reporter scheduling. |
values/otomi-operator/otomi-operator.gotmpl |
Configures Otomi Operator scheduling. |
values/otomi-console/otomi-console.gotmpl |
Configures console scheduling. |
values/otomi-api/otomi-api.gotmpl |
Configures API scheduling. |
values/otel-operator/otel-operator.gotmpl |
Configures OpenTelemetry Operator scheduling. |
values/oauth2-proxy/oauth2-proxy.gotmpl |
Configures OAuth2 Proxy scheduling. |
values/metrics-server/metrics-server.gotmpl |
Configures Metrics Server scheduling. |
values/loki/loki.gotmpl |
Configures Loki components. |
values/linode-cfw/linode-cfw.gotmpl |
Configures firewall controller scheduling. |
values/kyverno/kyverno.gotmpl |
Configures Kyverno controllers. |
values/kyverno/kyverno-raw.gotmpl |
Removes the node-selector mutation policy. Moderate, 1 vote: Knative operator and maintenance workloads lack native selector support. |
values/kubernetes-gateways/kubernetes-gateways.gotmpl |
Configures gateway scheduling. |
values/kserve/kserve.gotmpl |
Configures KServe controller scheduling. |
values/knative-serving/knative-serving-cr.gotmpl |
Configures Knative Serving workloads. Moderate, 2 votes: Knative operator workloads lack selector support. |
values/keycloak/keycloak.gotmpl |
Configures Keycloak scheduling. Moderate, 1 vote: external CNPG database pods lack a selector. |
values/istiod/istiod.gotmpl |
Configures Istiod scheduling. Moderate, 1 vote: ambient ztunnel and CNI pods lack selector propagation. |
values/istio-gateway/istio-egressgateway.yaml.gotmpl |
Configures egress gateway scheduling. |
values/harbor/harbor.gotmpl |
Configures Harbor components. Moderate, 1 vote: external CNPG database pods lack a selector. |
values/gitea/gitea.gotmpl |
Configures Gitea scheduling. Two moderate findings, 1 vote each: CNPG database and backup CronJob lack selectors. |
values/gitea/gitea-valkey.gotmpl |
Configures Valkey scheduling. |
values/git-server/git-server.gotmpl |
Configures Git Server scheduling. |
values/external-secrets/external-secrets.gotmpl |
Configures External Secrets globally. |
values/external-dns/external-dns.gotmpl |
Configures External DNS scheduling. |
values/cloudnative-pg/cloudnative-pg.gotmpl |
Configures CNPG operator scheduling. Moderate, 1 vote: generated database Cluster specs lack selector propagation. |
values/cloudnative-pg-plugin-barman-cloud/cloudnative-pg-plugin-barman-cloud.gotmpl |
Configures the CNPG plugin. |
values/cert-manager/cert-manager.gotmpl |
Configures Cert-Manager scheduling. Moderate, 2 votes: webhook, cainjector, and startupapicheck use a separate selector field. |
values/cert-manager-webhook-linode/cert-manager-webhook-linode.gotmpl |
Configures the Linode webhook. |
values/argocd/argocd.gotmpl |
Configures Argo CD scheduling globally. |
values/argocd-image-updater/argocd-image-updater.gotmpl |
Configures image updater scheduling. |
values/apl-operator/apl-operator.gotmpl |
Configures APL Operator scheduling. |
values/apl-keycloak-operator/apl-keycloak-operator.gotmpl |
Configures Keycloak operator scheduling. |
values/apl-harbor-operator/apl-harbor-operator.gotmpl |
Configures Harbor operator scheduling. |
values/apl-gitea-operator/apl-gitea-operator.gotmpl |
Configures Gitea operator scheduling. |
charts/tekton-triggers/values.yaml |
Defines selector defaults for Trigger components. |
charts/tekton-triggers/templates/release/deployments.yaml |
Renders selectors for controller and webhook pods. |
charts/tekton-triggers/templates/interceptor/deployment.yaml |
Renders the interceptor selector. |
charts/kubernetes-gateways/templates/configmap.yaml |
Renders gateway node selectors. |
charts/git-server/values.yaml |
Defines Git Server selector defaults. |
charts/git-server/templates/deployment.yaml |
Renders the Git Server selector. |
Review details
Suppressed comments (8)
values/cloudnative-pg/cloudnative-pg.gotmpl:18
- This selector only schedules the CNPG operator; the managed database Pods are scheduled from each
Clusterresource'sspec. The Gitea, Keycloak, and Harbor*-otomi-db.gotmplresources do not addspec.nodeSelector, so those database Pods lose the selector that the removed Kyverno policy previously applied in their namespaces. Propagate the map into every generated database Cluster spec.
nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 2 }}
values/gitea/gitea.gotmpl:259
- This schedules the Gitea application and Valkey, but the separate
gitea-otomi-dbCNPG release creates database pods in thegiteanamespace. ItsclusterSpechas no nodeSelector, so those pods lose the namespace-wide Kyverno mutation when this change lands. Add the selector to the CNPG cluster values too.
nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 2 }}
values/gitea/gitea.gotmpl:259
- The old policy matched every Pod in the
giteanamespace, but this change only configures the Gitea chart deployment. The rawgitea-backup-jobCronJob still emits a pod template withoutspec.nodeSelector, so scheduled backups no longer honor the requested placement after the policy is removed. Add the selector to that raw CronJob (and any other raw Gitea Pod resources).
nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 2 }}
values/harbor/harbor.gotmpl:27
- This schedules Harbor's chart-managed pods, but Harbor's external CNPG cluster is rendered by the separate
harbor-otomi-dbrelease in the sameharbornamespace. ItsclusterSpechas no nodeSelector, so removing the namespace-wide Kyverno mutation leaves the Harbor database pods outside the native policy. Add the selector to the CNPG cluster values as well.
nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 4 }}
values/istiod/istiod.gotmpl:8
- Adding a selector to
istioddoes not cover the other ambient Istio releases in the sameistio-systemnamespace:ztunnelhas a value that is never set here, andistio-cnihard-codes only the Linux selector. The removed Kyverno rule previously mutated all pods in that namespace, so ambientztunneland CNI pods will missotomi.nodeSelector.
nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 2 }}
values/keycloak/keycloak.gotmpl:120
- This schedules the Keycloak StatefulSet, but the separate
keycloak-otomi-dbCNPG release creates database pods in thekeycloaknamespace. ItsclusterSpechas no nodeSelector, so those pods lose the namespace-wide Kyverno mutation when this change lands. Add the selector to the CNPG cluster values too.
nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 2 }}
values/kyverno/kyverno-raw.gotmpl:2
- Removing this policy leaves platform pods in namespaces that are not covered by the new chart values without the global selector. For example,
knative-operatorstill renders both deployments without a nodeSelector (charts/knative-operator/templates/operator.yaml:73-87, 802-817), and themaintenanceJob/CronJob chart has no selector support (charts/jobs/templates/job.yaml:12,charts/jobs/templates/cronjob.yaml:19). Those workloads were included in the deleted policy's namespace list, sootomi.nodeSelectorwill no longer constrain them. Add native propagation for every remaining namespace/workload before deleting the policy.
{{- if $v.otomi.linodeLkeImageRepository }}
values/tekton-pipelines/tekton-pipelines.gotmpl:48
- Tekton's
default-pod-templateis merged into every TaskRun and PipelineRun, including user/team task pods. The previous Kyverno rule was limited to platform namespaces, so this new line broadens the policy and can make user pipeline workloads unschedulable on nodes carrying the platform-only labels. Keep the selector on the Tekton controllers, but remove it from the global default pod template unless this wider scheduling scope is intentional.
- Files reviewed: 47/47 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| gatewayAPI: | ||
| enabled: true | ||
|
|
||
| nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 2 }} |
| replicas: {{ $k.serving.replicas }} | ||
| workloads: | ||
| - name: controller | ||
| nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 6 }} |
|
|
||
| webhook: | ||
| resources: {{- $t.resources.pipelinesWebhook | toYaml | nindent 4 }} | ||
| nodeSelector: {{- toYaml $v.otomi.nodeSelector | nindent 4 }} |
2 tasks
j-zimnowoda
reviewed
Sep 11, 2026
Contributor
There was a problem hiding this comment.
Tested by deploying to the cluster, then creating a new node pool with label (apl=core). Then setting in the values repo:
otomi:
nodeSelector:
apl:core
Upon this change most of the pods migrated to the new node pool. However the following pods did follow the platform nodeSelector:
| Pod name | Namespace |
|---|---|
| cert-manager-cainjector-6dcc8dd9b5-b7mb2 | cert-manager |
| cert-manager-webhook-95785bbd6-f8n9g | cert-manager |
| gitea-db-1 | gitea |
| gitea-db-2 | gitea |
| harbor-otomi-db-1 | harbor |
| harbor-otomi-db-2 | harbor |
| harbor-registry-7c847dfd58-zqqcp | harbor |
| oauth2-proxy-redis-ha-server-0 | istio-system |
| keycloak-db-1 | keycloak |
| keycloak-db-2 | keycloak |
| knative-operator-647d4575bc-ddd76 | knative-operator |
| operator-webhook-5449db56d8-hd49m | knative-operator |
| net-gateway-api-controller-5667f5fc6c-flphq | knative-serving |
| net-gateway-api-webhook-866767b47d-4swwm | knative-serving |
| kyverno-admission-controller-796b9b6568-62s52 | kyverno |
| kyverno-background-controller-6bc7749777-4c47f | kyverno |
| kyverno-cleanup-controller-699d48c756-tnscq | kyverno |
| kyverno-reports-controller-5dc956c498-xkkq9 | kyverno |
| tekton-events-controller-5548dcd4fb-vl9b9 | tekton-pipelines |
IMHO, the prometheus-operator-prometheus-node-exporter should not follow the node selector. Instead it should deploy to every node - the same as platform-logs-collector already does.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📌 Summary
Used #3084 as baseline but started over because of the merge conflicts in there.
🔍 Reviewer Notes
🧹 Checklist