feat: add AI workload policies for GPU governance

Add 5 new policies for AI/ML workload governance on Kubernetes:

- k8sgpuresourcelimits: Enforce max GPU count per container
- k8srequiredgputoleration: Require GPU pods to tolerate GPU node taints
- k8sgpuactivedeadline: Require GPU pods to set activeDeadlineSeconds
- k8sgpusharedmemory: Require GPU containers to mount memory-backed /dev/shm
- k8srequiredgpuruntimeclass: Require GPU pods to use an allowed runtimeClassName

Each policy includes:
- Dual-engine implementation (Rego + CEL/K8sNativeValidation)
- OPA unit tests (21 tests total, all passing)
- Gator integration tests (suite.yaml with sample constraints and resources)
- exemptImages parameter support

Also adds an 'ai-workload' bundle to catalog.yaml that groups these policies
with the existing k8snounsupportedgpu policy.

Signed-off-by: Jaydip Gabani <gabanijaydip@gmail.com>

Author: JaydipGabani

artifacthub/library/general/gpuactivedeadline/1.0.0/artifacthub-pkg.yml

@@ -0,0 +1,22 @@
+version: 1.0.0
+name: k8sgpuactivedeadline
+displayName: GPU Active Deadline Required
+createdAt: "2026-03-17T00:04:28Z"
+description: Requires pods that request NVIDIA GPU resources (nvidia.com/gpu) to set activeDeadlineSeconds. This prevents runaway training jobs from holding GPU resources indefinitely.
+digest: 7edfe0c97c446e801bf2e6109ef3adbdac6c603b540cd9f76eef66e46b6082b8
+license: Apache-2.0
+homeURL: https://open-policy-agent.github.io/gatekeeper-library/website/gpuactivedeadline
+keywords:
+    - gatekeeper
+    - open-policy-agent
+    - policies
+readme: |-
+    # GPU Active Deadline Required
+    Requires pods that request NVIDIA GPU resources (nvidia.com/gpu) to set activeDeadlineSeconds. This prevents runaway training jobs from holding GPU resources indefinitely.
+install: |-
+    ### Usage
+    ```shell
+    kubectl apply -f https://raw.githubusercontent.com/open-policy-agent/gatekeeper-library/master/artifacthub/library/general/gpuactivedeadline/1.0.0/template.yaml
+    ```
+provider:
+    name: Gatekeeper Library

artifacthub/library/general/gpuactivedeadline/1.0.0/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+  - template.yaml

artifacthub/library/general/gpuactivedeadline/1.0.0/samples/gpu-job-with-deadline/constraint.yaml

@@ -0,0 +1,11 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sGpuActiveDeadline
+metadata:
+  name: require-gpu-deadline
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]
+  parameters:
+    maxActiveDeadlineSeconds: 86400

artifacthub/library/general/gpuactivedeadline/1.0.0/samples/gpu-job-with-deadline/example_allowed.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: gpu-job-with-deadline
+spec:
+  activeDeadlineSeconds: 3600
+  containers:
+    - name: training
+      image: nvidia/cuda:12.0-runtime
+      resources:
+        limits:
+          nvidia.com/gpu: "1"

artifacthub/library/general/gpuactivedeadline/1.0.0/samples/gpu-job-without-deadline/constraint.yaml

@@ -0,0 +1,9 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sGpuActiveDeadline
+metadata:
+  name: require-gpu-deadline
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]

artifacthub/library/general/gpuactivedeadline/1.0.0/samples/gpu-job-without-deadline/example_disallowed.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: gpu-job-without-deadline
+spec:
+  containers:
+    - name: training
+      image: nvidia/cuda:12.0-runtime
+      resources:
+        limits:
+          nvidia.com/gpu: "1"

artifacthub/library/general/gpuactivedeadline/1.0.0/samples/non-gpu-job/constraint.yaml

@@ -0,0 +1,9 @@
+apiVersion: constraints.gatekeeper.sh/v1beta1
+kind: K8sGpuActiveDeadline
+metadata:
+  name: require-gpu-deadline
+spec:
+  match:
+    kinds:
+      - apiGroups: [""]
+        kinds: ["Pod"]

artifacthub/library/general/gpuactivedeadline/1.0.0/samples/non-gpu-job/example_allowed.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: non-gpu-job
+spec:
+  containers:
+    - name: web
+      image: nginx:1.25
+      resources:
+        limits:
+          cpu: "500m"
+          memory: "128Mi"

artifacthub/library/general/gpuactivedeadline/1.0.0/suite.yaml

@@ -0,0 +1,29 @@
+kind: Suite
+apiVersion: test.gatekeeper.sh/v1alpha1
+metadata:
+  name: gpuactivedeadline
+tests:
+- name: gpu-job-with-deadline
+  template: template.yaml
+  constraint: samples/gpu-job-with-deadline/constraint.yaml
+  cases:
+  - name: example-allowed
+    object: samples/gpu-job-with-deadline/example_allowed.yaml
+    assertions:
+    - violations: no
+- name: gpu-job-without-deadline
+  template: template.yaml
+  constraint: samples/gpu-job-without-deadline/constraint.yaml
+  cases:
+  - name: example-disallowed
+    object: samples/gpu-job-without-deadline/example_disallowed.yaml
+    assertions:
+    - violations: yes
+- name: non-gpu-job
+  template: template.yaml
+  constraint: samples/non-gpu-job/constraint.yaml
+  cases:
+  - name: example-allowed
+    object: samples/non-gpu-job/example_allowed.yaml
+    assertions:
+    - violations: no

artifacthub/library/general/gpuactivedeadline/1.0.0/template.yaml

@@ -0,0 +1,139 @@
+apiVersion: templates.gatekeeper.sh/v1
+kind: ConstraintTemplate
+metadata:
+  name: k8sgpuactivedeadline
+  annotations:
+    metadata.gatekeeper.sh/title: "GPU Active Deadline Required"
+    metadata.gatekeeper.sh/version: 1.0.0
+    description: >-
+      Requires pods that request NVIDIA GPU resources (nvidia.com/gpu) to set
+      activeDeadlineSeconds. This prevents runaway training jobs from holding
+      GPU resources indefinitely.
+spec:
+  crd:
+    spec:
+      names:
+        kind: K8sGpuActiveDeadline
+      validation:
+        openAPIV3Schema:
+          type: object
+          description: >-
+            Requires GPU pods to set activeDeadlineSeconds.
+          properties:
+            maxActiveDeadlineSeconds:
+              description: >-
+                The maximum value allowed for activeDeadlineSeconds. Set to 0 to
+                only require the field is present without enforcing a maximum.
+              type: integer
+            exemptImages:
+              description: >-
+                Any container that uses an image that matches an entry in this list will be excluded
+                from enforcement. Prefix-matching can be signified with `*`.
+              type: array
+              items:
+                type: string
+  targets:
+    - target: admission.k8s.gatekeeper.sh
+      code:
+      - engine: K8sNativeValidation
+        source:
+          variables:
+          - name: containers
+            expression: 'has(variables.anyObject.spec.containers) ? variables.anyObject.spec.containers : []'
+          - name: initContainers
+            expression: 'has(variables.anyObject.spec.initContainers) ? variables.anyObject.spec.initContainers : []'
+          - name: ephemeralContainers
+            expression: 'has(variables.anyObject.spec.ephemeralContainers) ? variables.anyObject.spec.ephemeralContainers : []'
+          - name: exemptImagePrefixes
+            expression: |
+              !has(variables.params.exemptImages) ? [] :
+                variables.params.exemptImages.filter(image, image.endsWith("*")).map(image, string(image).replace("*", ""))
+          - name: exemptImageExplicit
+            expression: |
+              !has(variables.params.exemptImages) ? [] :
+                variables.params.exemptImages.filter(image, !image.endsWith("*"))
+          - name: exemptImages
+            expression: |
+              (variables.containers + variables.initContainers + variables.ephemeralContainers).filter(container,
+                container.image in variables.exemptImageExplicit ||
+                variables.exemptImagePrefixes.exists(exemption, string(container.image).startsWith(exemption))
+              ).map(container, container.image)
+          - name: podRequestsGpu
+            expression: |
+              (variables.containers + variables.initContainers + variables.ephemeralContainers).exists(container,
+                !(container.image in variables.exemptImages) &&
+                has(container.resources) &&
+                has(container.resources.limits) &&
+                "nvidia.com/gpu" in container.resources.limits &&
+                quantity(string(container.resources.limits["nvidia.com/gpu"])).compareTo(quantity("0")) > 0
+              )
+          - name: hasDeadline
+            expression: 'has(variables.anyObject.spec.activeDeadlineSeconds)'
+          - name: maxDeadline
+            expression: 'has(variables.params.maxActiveDeadlineSeconds) ? variables.params.maxActiveDeadlineSeconds : 0'
+          validations:
+          - expression: '!variables.podRequestsGpu || variables.hasDeadline'
+            messageExpression: '"Pod <" + variables.anyObject.metadata.name + "> requests GPU resources but does not set activeDeadlineSeconds"'
+          - expression: '!variables.podRequestsGpu || !variables.hasDeadline || variables.maxDeadline == 0 || variables.anyObject.spec.activeDeadlineSeconds <= variables.maxDeadline'
+            messageExpression: '"Pod <" + variables.anyObject.metadata.name + "> sets activeDeadlineSeconds to " + string(variables.anyObject.spec.activeDeadlineSeconds) + ", which exceeds the maximum allowed " + string(variables.maxDeadline)'
+      - engine: Rego
+        source:
+          rego: |
+            package k8sgpuactivedeadline
+
+            violation[{"msg": msg}] {
+                pod_requests_gpu
+                not has_active_deadline
+                msg := sprintf("Pod <%v> requests GPU resources but does not set activeDeadlineSeconds", [input.review.object.metadata.name])
+            }
+
+            violation[{"msg": msg}] {
+                pod_requests_gpu
+                has_active_deadline
+                max_deadline := object.get(input, ["parameters", "maxActiveDeadlineSeconds"], 0)
+                max_deadline > 0
+                deadline := input.review.object.spec.activeDeadlineSeconds
+                deadline > max_deadline
+                msg := sprintf("Pod <%v> sets activeDeadlineSeconds to %v, which exceeds the maximum allowed %v", [input.review.object.metadata.name, deadline, max_deadline])
+            }
+
+            pod_requests_gpu {
+                container := input_containers[_]
+                not is_exempt(container)
+                gpu := container.resources.limits["nvidia.com/gpu"]
+                to_number(gpu) > 0
+            }
+
+            has_active_deadline {
+                input.review.object.spec.activeDeadlineSeconds
+            }
+
+            input_containers[c] {
+                c := input.review.object.spec.containers[_]
+            }
+
+            input_containers[c] {
+                c := input.review.object.spec.initContainers[_]
+            }
+
+            input_containers[c] {
+                c := input.review.object.spec.ephemeralContainers[_]
+            }
+
+            is_exempt(container) {
+                exempt_images := object.get(input, ["parameters", "exemptImages"], [])
+                img := container.image
+                exemption := exempt_images[_]
+                _matches_exemption(img, exemption)
+            }
+
+            _matches_exemption(img, exemption) {
+                not endswith(exemption, "*")
+                exemption == img
+            }
+
+            _matches_exemption(img, exemption) {
+                endswith(exemption, "*")
+                prefix := trim_suffix(exemption, "*")
+                startswith(img, prefix)
+            }