feat: Check if admission controller replica count is set to zero (#6213)

* ensure admission controller is always running with 1+ replicas

Signed-off-by: Ashwin901 <ashwinprasanna9@gmail.com>

* ensure all deployments are running with 1+ replicas

Signed-off-by: Ashwin901 <ashwinprasanna9@gmail.com>

* call helper function from deployment template

Signed-off-by: Ashwin901 <ashwinprasanna9@gmail.com>

* Update the function used to check the number of replicas

Signed-off-by: Ashwin901 <ashwinprasanna9@gmail.com>

* add an entry in changelog

Signed-off-by: Ashwin901 <ashwinprasanna9@gmail.com>

---------

Signed-off-by: Ashwin901 <ashwinprasanna9@gmail.com>
Co-authored-by: Charles-Edouard Brétéché <charled.breteche@gmail.com>

charts/kyverno/Chart.yaml

@@ -28,3 +28,5 @@ annotations:
   artifacthub.io/changes: |
     - kind: added
       description: make sigstore volume configurable
+    - kind: changed
+      description: no deployments can run with 0 replicas

charts/kyverno/templates/_helpers/_deployment.tpl

@@ -0,0 +1,8 @@
+{{/* vim: set filetype=mustache: */}}
+
+{{- define "kyverno.deployment.replicas" -}}
+  {{- if eq . 0 -}}
+    {{- fail "Kyverno does not support running with 0 replicas. Please provide a non-zero value." -}}
+  {{- end -}}
+  {{- . -}}
+{{- end -}}

charts/kyverno/templates/admission-controller/deployment.yaml

@@ -7,9 +7,7 @@ metadata:
   labels:
     {{- include "kyverno.admission-controller.labels" . | nindent 4 }}
 spec:
-  {{- with .Values.replicaCount }}
-  replicas: {{ . }}
-  {{- end }}
+  replicas: {{ template "kyverno.deployment.replicas" .Values.replicaCount }}
   selector:
     matchLabels:
       {{- include "kyverno.admission-controller.matchLabels" . | nindent 6 }}

charts/kyverno/templates/background-controller/deployment.yaml

@@ -8,9 +8,7 @@ metadata:
     {{- include "kyverno.background-controller.labels" . | nindent 4 }}
   namespace: {{ template "kyverno.namespace" . }}
 spec:
-  {{- with .Values.backgroundController.replicas }}
-  replicas: {{ . }}
-  {{- end }}
+  replicas: {{ template "kyverno.deployment.replicas" .Values.backgroundController.replicas }}
   {{- with .Values.backgroundController.updateStrategy }}
   strategy:
     {{- toYaml . | nindent 4 }}

charts/kyverno/templates/cleanup-controller/deployment.yaml

@@ -8,9 +8,7 @@ metadata:
     {{- include "kyverno.cleanup-controller.labels" . | nindent 4 }}
   namespace: {{ template "kyverno.namespace" . }}
 spec:
-  {{- with .Values.cleanupController.replicas }}
-  replicas: {{ . }}
-  {{- end }}
+  replicas: {{ template "kyverno.deployment.replicas" .Values.cleanupController.replicas }}
   {{- with .Values.cleanupController.updateStrategy }}
   strategy:
     {{- toYaml . | nindent 4 }}

charts/kyverno/templates/reports-controller/deployment.yaml

@@ -8,9 +8,7 @@ metadata:
     {{- include "kyverno.reports-controller.labels" . | nindent 4 }}
   namespace: {{ template "kyverno.namespace" . }}
 spec:
-  {{- with .Values.reportsController.replicas }}
-  replicas: {{ . }}
-  {{- end }}
+  replicas: {{ template "kyverno.deployment.replicas" .Values.reportsController.replicas }}
   {{- with .Values.reportsController.updateStrategy }}
   strategy:
     {{- toYaml . | nindent 4 }}