add kyverno policies

Signed-off-by: gwg313 <gwg313@pm.me>

platform/kyverno/policies/50-cleanup/cleanup-evicted-pods.yaml

@@ -0,0 +1,22 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterCleanupPolicy
+metadata:
+  name: cleanup-evicted-pods
+spec:
+  match:
+    any:
+      - resources:
+          kinds:
+            - Pod
+
+  conditions:
+    all:
+      - key: "{{ target.status.reason }}"
+        operator: Equals
+        value: Evicted
+
+      - key: "{{ time_diff('{{ target.metadata.creationTimestamp }}','{{ time_now_utc() }}') }}"
+        operator: GreaterThan
+        value: 1h
+
+  schedule: "0 * * * *"

platform/kyverno/policies/50-cleanup/cleanup-old-replicasets.yaml

@@ -0,0 +1,22 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterCleanupPolicy
+metadata:
+  name: cleanup-old-replicasets
+spec:
+  match:
+    any:
+      - resources:
+          kinds:
+            - ReplicaSet
+
+  conditions:
+    all:
+      - key: "{{ target.spec.replicas || `0` }}"
+        operator: Equals
+        value: 0
+
+      - key: "{{ time_diff('{{ target.metadata.creationTimestamp }}','{{ time_now_utc() }}') }}"
+        operator: GreaterThan
+        value: 168h
+
+  schedule: "0 3 * * *"

platform/kyverno/policies/50-cleanup/cleanup-terminal-pods.yaml

@@ -0,0 +1,24 @@
+apiVersion: kyverno.io/v2beta1
+kind: ClusterCleanupPolicy
+metadata:
+  name: cleanup-terminal-pods
+spec:
+  match:
+    any:
+      - resources:
+          kinds:
+            - Pod
+
+  conditions:
+    all:
+      - key: "{{ target.status.phase }}"
+        operator: AnyIn
+        value:
+          - Succeeded
+          - Failed
+
+      - key: "{{ time_diff('{{ target.metadata.creationTimestamp }}','{{ time_now_utc() }}') }}"
+        operator: GreaterThan
+        value: 30m
+
+  schedule: "*/15 * * * *"

platform/kyverno/policies/50-cleanup/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cleanup-evicted-pods.yaml
+  - cleanup-old-replicasets.yaml
+  - cleanup-terminal-pods.yaml
+
+commonLabels:
+  app.kubernetes.io/part-of: kyverno-policies
+  policy-tier: cleanup
+
+commonAnnotations:
+  argocd.argoproj.io/sync-wave: "4"