feat(helm): add opt-in schedulerName and runtimeClassName to the controller pods by somaz94 · Pull Request #16428 · kyverno/kyverno

somaz94 · 2026-07-02T07:45:30Z

Explanation

Adds two optional pod-spec fields — schedulerName and runtimeClassName — to all four Kyverno controllers (admission, background, cleanup, reports). They let operators run the Kyverno pods with a non-default scheduler or under a specific RuntimeClass (e.g. gVisor / Kata), which some clusters require for sandboxing or custom scheduling. This is an additive, opt-in change: both fields are exposed as a global.* default plus per-controller overrides, mirroring the existing priorityClassName pattern, and default to an empty string so existing installs render identically.

Related issue

No existing issue; this mirrors the existing priorityClassName / topologySpreadConstraints values to complete the pod scheduling/runtime surface across the controllers.

Documentation (required for features)

I have sent the draft PR to add or update the documentation

The new values are self-documented in the chart README via helm-docs (regenerated with helm-docs v1.14.2). Happy to open a kyverno/website PR if maintainers prefer the values pages updated too.

What type of PR is this

/kind feature

Proposed Changes

global.schedulerName / global.runtimeClassName + per-controller overrides (<controller>.schedulerName|runtimeClassName | default .Values.global.*) for admission / background / cleanup / reports controllers, mirroring priorityClassName.
Wired into each controller Deployment pod spec with the same {{- with ... }} / {{ . | quote }} guard as priorityClassName.
README regenerated via make codegen-helm-docs.

Validation:

helm template default render byte-identical to main
All four controllers render both fields when set (global + per-controller override verified)
ct lint --charts charts/kyverno passed
README diff is exactly the 10 new value rows (no helm-docs drift)

Copilot

Pull request overview

This PR extends the Kyverno Helm chart to support opt-in PodSpec scheduling/runtime controls across all four controller Deployments (admission, background, cleanup, reports) by exposing schedulerName and runtimeClassName as both global defaults and per-controller overrides, consistent with the existing priorityClassName pattern.

Changes:

Added global.schedulerName and global.runtimeClassName, plus per-controller schedulerName/runtimeClassName values for all controllers.
Wired the new values into each controller Deployment PodSpec using the same guarded rendering pattern used for priorityClassName.
Regenerated the chart README values table to document the new settings.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
charts/kyverno/values.yaml	Adds global + per-controller `schedulerName` and `runtimeClassName` values with empty-string defaults.
charts/kyverno/templates/admission-controller/deployment.yaml	Conditionally renders `schedulerName` and `runtimeClassName` into the admission controller PodSpec.
charts/kyverno/templates/background-controller/deployment.yaml	Conditionally renders `schedulerName` and `runtimeClassName` into the background controller PodSpec.
charts/kyverno/templates/cleanup-controller/deployment.yaml	Conditionally renders `schedulerName` and `runtimeClassName` into the cleanup controller PodSpec.
charts/kyverno/templates/reports-controller/deployment.yaml	Conditionally renders `schedulerName` and `runtimeClassName` into the reports controller PodSpec.
charts/kyverno/README.md	Documents the new values in the generated chart values table.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

somaz94 · 2026-07-15T08:02:29Z

+  # -- Global scheduler name used to schedule the pods. Non-global values will override the global value.
+  schedulerName: ''
+
+  # -- Global runtime class name applied to the pods. Non-global values will override the global value.
+  runtimeClassName: ''


You're right about the default semantics — | default .Values.global.* treats an empty string as unset, so a per-controller "" won't disable a non-empty global value.

I kept the wording as-is deliberately, for consistency: these two entries mirror the existing global.priorityClassName directly above them, which uses the identical | default .Values.global.priorityClassName pattern and the identical description (added in #15712). Rewording only the two new lines would leave three entries with identical semantics described three different ways.

Happy to go either way if a maintainer prefers:

leave as-is (current) — consistent with the established convention, or

reword all three global.* entries together — accurate, but touches a line outside this PR's scope.

Just let me know which you'd prefer.

somaz94 · 2026-07-15T08:02:35Z

+| global.schedulerName | string | `""` | Global scheduler name used to schedule the pods. Non-global values will override the global value. |
+| global.runtimeClassName | string | `""` | Global runtime class name applied to the pods. Non-global values will override the global value. |


Same as the values.yaml thread — replied there. Note this README table is generated by helm-docs from the values.yaml comments, so it isn't hand-edited; it would follow automatically from whichever wording we settle on.

Copilot

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.

somaz94 · 2026-07-30T08:07:37Z

Gentle ping — this has been open for four weeks with no human review yet.

It's a small, self-contained chart change (+64/−0): schedulerName and runtimeClassName exposed as global defaults with per-controller overrides, following the exact priorityClassName idiom already used directly above each hunk. Verified locally that setting only the global values applies them to all four controller Deployments, a per-controller value overrides the global, and leaving both unset emits no field at all. charts/kyverno/README.md is regenerated with the pinned helm-docs v1.14.2 (no diff). All checks green.

@realshuting @fjogeleit — would one of you have a moment to take a look? Happy to rebase if you'd prefer the branch up to date before merging.

…roller pods Signed-off-by: somaz <genius5711@gmail.com>

somaz94 · 2026-08-31T02:44:45Z

Correction to my ping above: I said "all checks green", which wasn't right. The workflow runs on this PR have never actually executed — they're all sitting at action_required waiting for a first-time-contributor approval, and the ones from 30 Jul show as failures only because they expired unrun (0 jobs each). So there's no test failure here, but there's no CI signal either, and I shouldn't have implied there was.

Could a maintainer approve the queued runs? That's the only thing standing between this and a real signal. I've left the branch alone rather than rebasing to clear the behind label, since a new head just re-arms the gate — that's happened six times already, most recently when kyverno-pr-updater merged main on 18 Aug.

@realshuting @fjogeleit — could one of you take a look?

Copilot AI review requested due to automatic review settings July 2, 2026 07:45

github-actions Bot added kind/helm Helm charts kind/helm-kyverno Kyverno Helm chart kind/documentation Documentation changes labels Jul 2, 2026

Copilot started reviewing on behalf of somaz94 July 2, 2026 07:45 View session

Copilot AI reviewed Jul 2, 2026

View reviewed changes

somaz94 added a commit to somaz94/somaz94 that referenced this pull request Jul 2, 2026

docs: add kyverno/kyverno#16428 to OSS contributions

51be661

Copilot AI review requested due to automatic review settings July 9, 2026 03:35

somaz94 force-pushed the feat/chart-scheduler-runtime-class branch from 3120cd5 to 7c575a8 Compare July 9, 2026 03:35

Copilot started reviewing on behalf of somaz94 July 9, 2026 03:36 View session

somaz94 marked this pull request as ready for review July 9, 2026 03:37

somaz94 requested review from a team, eddycharly and realshuting as code owners July 9, 2026 03:37

dosubot Bot added the size:S This PR changes 10-29 lines, ignoring generated files. label Jul 9, 2026

Copilot AI reviewed Jul 9, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 02:50

somaz94 force-pushed the feat/chart-scheduler-runtime-class branch from 7c575a8 to 7fdaa6c Compare July 13, 2026 02:50

Copilot started reviewing on behalf of somaz94 July 13, 2026 02:50 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings July 13, 2026 08:25

Copilot started reviewing on behalf of kyverno-bot July 13, 2026 08:25 View session

Copilot AI reviewed Jul 13, 2026

View reviewed changes

JimBugwadia added this to the Kyverno Release 1.19.0 milestone Jul 19, 2026

somaz94 force-pushed the feat/chart-scheduler-runtime-class branch from e8703a7 to 7aba370 Compare July 28, 2026 06:57

JimBugwadia removed this from the Kyverno Release 1.19.0 milestone Jul 28, 2026

somaz94 force-pushed the feat/chart-scheduler-runtime-class branch from a9691bb to 8f2d63f Compare July 30, 2026 02:38

somaz94 force-pushed the feat/chart-scheduler-runtime-class branch from 8f2d63f to ae1ea95 Compare August 4, 2026 03:50

feat(helm): add opt-in schedulerName and runtimeClassName to the cont…

66fac88

…roller pods Signed-off-by: somaz <genius5711@gmail.com>

somaz94 force-pushed the feat/chart-scheduler-runtime-class branch from 99a3c25 to 66fac88 Compare August 18, 2026 02:02

Merge branch 'main' into feat/chart-scheduler-runtime-class

2cfc55f

Navigation Menu

feat(helm): add opt-in schedulerName and runtimeClassName to the controller pods - #16428

feat(helm): add opt-in schedulerName and runtimeClassName to the controller pods#16428
somaz94 wants to merge 2 commits into
kyverno:mainfrom
somaz94:feat/chart-scheduler-runtime-class

somaz94 commented Jul 2, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

somaz94 Jul 15, 2026

Uh oh!

somaz94 Jul 15, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

somaz94 commented Jul 30, 2026

Uh oh!

somaz94 commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		\| global.schedulerName \| string \| `""` \| Global scheduler name used to schedule the pods. Non-global values will override the global value. \|
		\| global.runtimeClassName \| string \| `""` \| Global runtime class name applied to the pods. Non-global values will override the global value. \|

Conversation

somaz94 commented Jul 2, 2026

Explanation

Related issue

Documentation (required for features)

What type of PR is this

Proposed Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

somaz94 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

somaz94 Jul 15, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

somaz94 commented Jul 30, 2026

Uh oh!

somaz94 commented Aug 31, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants