As input to the docs, I can describe how the new SSA feature for generate-rules solved an issue we had after adding a generate-policy for serviceaccounts to our clusters. More details in the Slack thread.

We run Kyverno on Openshift, and Openshift has a lot of legacy features that retain - and are impossible to turn off. One of these is that openshift-controller-manager will unconditionally set secrets and imagePullSecrets on any service account. The Kyverno policy contains a simple generate rule (irrelevant details omitted):

generate:
  apiVersion: v1
  kind: ServiceAccount
  namespace: "{{ request.object.metadata.name }}"
  name: automation
  synchronize: true

When this rule is active, it turns out that Kyverno and openshift-controller-manager start fighting over the desired state of the service account fields. Kyverno thinks that secrets and imagePullSecrets should be empty, while openshift-controller-manager thinks not. What makes the situation even worse, is that Openshift uses generateName for the secret names - resulting in a new secret being created every time the fields are set. In the end, all the secrets filled up etcd causing a cluster outage.

After removing the culprit policy and cleaning up thousands of secrets, we managed to get our clusters running again. Since I work with Kubernetes controllers I know SSA is supposed to solve this competing-controller issue, I asked on Slack about SSA support in Kyverno and was referred to this issue/PR by @realshuting.

And I can confirm that enabling SSA on this policy (useServerSideApply: true) seems to work a lot better. Kyverno manages just the fields that are specified in the policy. This allows Openshift to do its thing with the other fields.

[Enhancement] useServerSideApply docs #925

Description

Description

Slack discussion

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions