kyverno pods don't have node anti-affinity rules.

Summary

Since kyverno pods don't have any soft anti-affinity rules, they can be all or nearly all scheduled on the same node. This is what happened on my workload-cluster (Sylva v1.6.20) despite the available resources on the other nodes. Meaning that losing this node will disrupt completely kyverno waiting to get it back.

kubectl get pods -n kyverno -o wide
NAME                                             READY   STATUS    RESTARTS      AGE   IP              NODE                            NOMINATED NODE   READINESS GATES
kyverno-admission-controller-5898858d8d-8pk2q    1/1     Running   0             26d   100.72.89.162   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-admission-controller-5898858d8d-mmlv4    1/1     Running   0             26d   100.72.89.142   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-admission-controller-5898858d8d-wnhcw    1/1     Running   0             26d   100.72.89.164   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-background-controller-5b849d6c98-qtwxd   1/1     Running   0             26d   100.72.89.150   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-background-controller-5b849d6c98-tcghz   1/1     Running   0             26d   100.72.89.159   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-background-controller-5b849d6c98-wb5k7   1/1     Running   0             26d   100.72.89.149   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-cleanup-controller-5664b7b9b6-76jp2      1/1     Running   2 (24d ago)   26d   100.72.89.146   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-cleanup-controller-5664b7b9b6-9vqsn      1/1     Running   0             26d   100.72.89.141   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-cleanup-controller-5664b7b9b6-ndhsc      1/1     Running   0             24d   100.72.135.77   rocket133-cp-07aaacbff5-z8fdh   <none>           <none>
kyverno-reports-controller-c9cf785b9-57rgq       1/1     Running   1 (24d ago)   26d   100.72.89.147   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-reports-controller-c9cf785b9-qbd6t       1/1     Running   0             26d   100.72.89.160   rocket133-md0-hqck8-jrg5t       <none>           <none>
kyverno-reports-controller-c9cf785b9-vgw64       1/1     Running   1 (25d ago)   26d   100.72.89.148   rocket133-md0-hqck8-jrg5t       <none>           <none>

related references

Details