Update anti-affinity to the soft limit (#2441)

charts/kyverno/templates/deployment.yaml

@@ -33,14 +33,16 @@ spec:
       {{- if .Values.antiAffinity.enable }}
       affinity:
         podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
+          preferredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
+          - weight: 1
-              matchExpressions:
+            podAffinityTerm:
-              - key: app.kubernetes.io/name
+              labelSelector:
-                operator: In
+                matchExpressions:
-                values:
+                - key: app.kubernetes.io/name
-                - kyverno
+                  operator: In
-            topologyKey: {{ .Values.antiAffinity.topologyKey }}
+                  values:
+                  - kyverno
+              topologyKey: {{ .Values.antiAffinity.topologyKey }}
       {{- end }}
       {{- with .Values.nodeSelector }}
       nodeSelector: {{ tpl (toYaml .) $ | nindent 8 }}

definitions/install.yaml

@@ -6590,14 +6590,16 @@ spec:
     spec:
       affinity:
         podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
+          preferredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
+          - podAffinityTerm:
-              matchExpressions:
+              labelSelector:
-              - key: app.kubernetes.io/name
+                matchExpressions:
-                operator: In
+                - key: app.kubernetes.io/name
-                values:
+                  operator: In
-                - kyverno
+                  values:
-            topologyKey: kubernetes.io/hostname
+                  - kyverno
+              topologyKey: kubernetes.io/hostname
+            weight: 1
       containers:
       - args:
         - --filterK8sResources=[Event,*,*][*,kube-system,*][*,kube-public,*][*,kube-node-lease,*][Node,*,*][APIService,*,*][TokenReview,*,*][SubjectAccessReview,*,*][*,kyverno,*][Binding,*,*][ReplicaSet,*,*][ReportChangeRequest,*,*][ClusterReportChangeRequest,*,*][PolicyReport,*,*][ClusterPolicyReport,*,*]

definitions/manifest/deployment.yaml

@@ -23,14 +23,16 @@ spec:
     spec:
       affinity:
         podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
+          preferredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
+          - weight: 1
-              matchExpressions:
+            podAffinityTerm:
-              - key: app.kubernetes.io/name
+              labelSelector:
-                operator: In
+                matchExpressions:
-                values:
+                - key: app.kubernetes.io/name
-                - kyverno
+                  operator: In
-            topologyKey: "kubernetes.io/hostname"
+                  values:
+                  - kyverno
+              topologyKey: "kubernetes.io/hostname"
       serviceAccountName: kyverno-service-account
       securityContext:
         runAsNonRoot: true