fix admission policy: need to exampt appwrapper-owned controller reso…

…urces (#32)
project-codeflare · Aug 7, 2024 · a31a8ab · a31a8ab
1 parent cb74599
commit a31a8ab
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/setup.k8s-v1.30/admission-policy.yaml b/setup.k8s-v1.30/admission-policy.yaml
@@ -18,6 +18,9 @@ spec:
       apiVersions: ["v1"]
       operations:  ["CREATE", "UPDATE"]
       resources:   ["rayjobs","rayclusters"]
+  matchConditions:
+  - name: exclude-appwrapper-owned
+    expression: "!(has(object.metadata.ownerReferences) && object.metadata.ownerReferences.exists(o, o.apiVersion=='workload.codeflare.dev/v1beta2'&&o.kind=='AppWrapper'&&o.controller))"
   validations:
     - expression: "has(object.metadata.labels) && 'kueue.x-k8s.io/queue-name' in object.metadata.labels && object.metadata.labels['kueue.x-k8s.io/queue-name'] != ''"
       message: "All non-AppWrapper workloads must have a 'kueue.x-k8s.io/queue-name' label with non-empty value."