Compare PDB and replicaCount/hpa minValue

[safredAAs]

Hello everyone,

I currently have the following scenario that I want to put into a rego rule:

Currently in my cluster, there is the possiblity to deploy an application that as has an PDB set to 1 and the replicaCount to 1. This means that the application will block node upgrades as the pod can't be evicted due to the PDB. The same issues appears if the HPA is acivated but only set to 1.

I would like to have a rego rule, that compares the PDB value to the one in the replicaCount or the HPA and rejects the deployment if the HPA/replicaCount is the same or lower as the PDB. So the replica/HPA count should always be higher than the PDB.

Is this in any way possible to do?

Thanks for input, cheers!

[peteroneilljr]

hi @safredAAs this sounds pretty straightforward, creating a policy rule that says

allow {
    PDB < HPA/replicaCount
}

Can you show what your policy currently looks like and I can advise from there?