Add nodeSelector for cleanupJob CronJob resources (#7851)

Fixes #7826

Signed-off-by: Trey Dockendorf <tdockendorf@osc.edu>

charts/kyverno/Chart.yaml

@@ -50,3 +50,5 @@ annotations:
       description: change to enable webhook cleanup hook by default
     - kind: added
       description: allow pod labels for cleanup jobs
+    - kind: added
+      description: allow nodeSelector for cleanup jobs

charts/kyverno/README.md

@@ -650,6 +650,7 @@ The chart values are organised per component.
 | cleanupJobs.admissionReports.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers |
 | cleanupJobs.admissionReports.resources | object | `{}` | Job resources |
 | cleanupJobs.admissionReports.tolerations | list | `[]` | List of node taints to tolerate |
+| cleanupJobs.admissionReports.nodeSelector | object | `{}` | Node labels for pod assignment |
 | cleanupJobs.admissionReports.podAnnotations | object | `{}` | Pod Annotations |
 | cleanupJobs.admissionReports.podLabels | object | `{}` | Pod labels |
 | cleanupJobs.clusterAdmissionReports.enabled | bool | `true` | Enable cleanup cronjob |
@@ -665,6 +666,7 @@ The chart values are organised per component.
 | cleanupJobs.clusterAdmissionReports.securityContext | object | `{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true,"seccompProfile":{"type":"RuntimeDefault"}}` | Security context for the containers |
 | cleanupJobs.clusterAdmissionReports.resources | object | `{}` | Job resources |
 | cleanupJobs.clusterAdmissionReports.tolerations | list | `[]` | List of node taints to tolerate |
+| cleanupJobs.clusterAdmissionReports.nodeSelector | object | `{}` | Node labels for pod assignment |
 | cleanupJobs.clusterAdmissionReports.podAnnotations | object | `{}` | Pod Annotations |
 | cleanupJobs.clusterAdmissionReports.podLabels | object | `{}` | Pod Labels |
 

charts/kyverno/ci/cleanupJobs-values.yaml

@@ -0,0 +1,7 @@
+cleanupJobs:
+  admissionReports:
+    nodeSelector:
+      kubernetes.io/os: linux
+  clusterAdmissionReports:
+    nodeSelector:
+      kubernetes.io/os: linux

charts/kyverno/templates/cleanup/cleanup-admission-reports.yaml

@@ -61,4 +61,8 @@ spec:
           tolerations:
             {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}
+          {{- with .Values.cleanupJobs.admissionReports.nodeSelector }}
+          nodeSelector:
+            {{- tpl (toYaml .) $ | nindent 12 }}
+          {{- end }}
 {{- end -}}

charts/kyverno/templates/cleanup/cleanup-cluster-admission-reports.yaml

@@ -61,4 +61,8 @@ spec:
           tolerations:
             {{- tpl (toYaml .) $ | nindent 12 }}
           {{- end }}
+          {{- with .Values.cleanupJobs.clusterAdmissionReports.nodeSelector }}
+          nodeSelector:
+            {{- tpl (toYaml .) $ | nindent 12 }}
+          {{- end }}
 {{- end -}}

charts/kyverno/values.yaml

@@ -448,6 +448,9 @@ cleanupJobs:
     # -- List of node taints to tolerate
     tolerations: []
 
+    # -- Node labels for pod assignment
+    nodeSelector: {}
+
     # -- Pod Annotations
     podAnnotations: {}
 
@@ -507,6 +510,9 @@ cleanupJobs:
     # -- List of node taints to tolerate
     tolerations: []
 
+    # -- Node labels for pod assignment
+    nodeSelector: {}
+
     # -- Pod Annotations
     podAnnotations: {}