fix(kyverno): correct chart webhook schema (map + forceFailurePolicyIgnore)

Kyverno HelmRelease install failed at Helm templating: config.webhooks was a
LIST [{failurePolicy, namespaceSelector}], but the kyverno 3.3.9 chart expects
config.webhooks to be a MAP (webhooks.namespaceSelector) — the chart helper reads
.namespaceSelector off the value directly ('can't evaluate field namespaceSelector
in type []interface {}'). Also, failurePolicy is not a per-webhook field here; the
chart's global switch is config.forceFailurePolicyIgnore.enabled (bool).

Fix: config.webhooks -> map with namespaceSelector (system+platform excludes);
add config.forceFailurePolicyIgnore.enabled = ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}.
Renamed the cluster-var KYVERNO_WEBHOOK_FAILURE_POLICY (Fail/Ignore) ->
KYVERNO_FORCE_FAILURE_POLICY_IGNORE (false base / true dev). Verified with
helm template (renders 73 objects, no error); gate PASS.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

clusters/base/cluster-vars.yaml

@@ -31,9 +31,9 @@ data:
   # --- admission enforcement (Kyverno, ADR-0011). Base defaults are the STRICT/prod posture;
   #     the dev overlay softens them for bootstrap (Audit / Ignore / 1) so a cold cluster can
   #     come up before policies are proven and admission is HA. ---
-  KYVERNO_VALIDATION_ACTION: "Enforce"      # dev: Audit (observe before enforcing)
-  KYVERNO_WEBHOOK_FAILURE_POLICY: "Fail"    # dev: Ignore (fail-open during bootstrap)
-  KYVERNO_ADMISSION_REPLICAS: "3"           # dev: 1 (no HA needed to iterate)
+  KYVERNO_VALIDATION_ACTION: "Enforce"            # dev: Audit (observe before enforcing)
+  KYVERNO_FORCE_FAILURE_POLICY_IGNORE: "false"    # dev: "true" (chart forceFailurePolicyIgnore = fail-open)
+  KYVERNO_ADMISSION_REPLICAS: "3"                 # dev: 1 (no HA needed to iterate)
 
   # --- identity / auth (ADR-0014) ---
   KEYCLOAK_REPLICAS: "1"                     # dev 1 | prod 2 (HA)

clusters/dev/kustomization.yaml

@@ -91,8 +91,8 @@ patches:
         path: /data/KYVERNO_VALIDATION_ACTION
         value: "Audit"
       - op: replace
-        path: /data/KYVERNO_WEBHOOK_FAILURE_POLICY
-        value: "Ignore"
+        path: /data/KYVERNO_FORCE_FAILURE_POLICY_IGNORE
+        value: "true"
       - op: replace
         path: /data/KYVERNO_ADMISSION_REPLICAS
         value: "1"

platform/kyverno/admission/helmrelease.yaml

@@ -44,22 +44,23 @@ spec:
       enabled: true
     cleanupController:
       enabled: true
-    # Webhook failure policy — cluster-vars knob (prod Fail / dev Ignore). Fail is fail-CLOSED
-    # (reject rather than silently admit when the webhook is unreachable, coordination-protocol.md
-    # #8); dev uses Ignore (fail-open) so a cold/unhealthy Kyverno cannot brick admission during
-    # bootstrap. The namespaceSelector ALSO excludes system + platform namespaces at the webhook
-    # layer — belt-and-suspenders: policies already scope to app-namespace=true, but this
-    # guarantees kube-system/flux-system/CNI/storage/monitoring admission never routes to Kyverno.
+    # config.webhooks is a MAP in the Kyverno chart (NOT a list — a list breaks the chart's
+    # webhook helper). namespaceSelector excludes system + platform namespaces at the webhook layer
+    # (belt-and-suspenders: the policies already scope to app-namespace=true). forceFailurePolicyIgnore
+    # is the chart's global fail-open switch — a cluster-vars knob: dev enables it (a cold/unhealthy
+    # Kyverno can't brick admission during bootstrap); prod disables it (fail-closed per
+    # coordination-protocol.md #8).
     config:
+      forceFailurePolicyIgnore:
+        enabled: ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}
       webhooks:
-        - failurePolicy: ${KYVERNO_WEBHOOK_FAILURE_POLICY}
-          namespaceSelector:
-            matchExpressions:
-              - key: kubernetes.io/metadata.name
-                operator: NotIn
-                values:
-                  - kube-system
-                  - flux-system
-                  - kyverno
-                  - longhorn-system
-                  - monitoring
+        namespaceSelector:
+          matchExpressions:
+            - key: kubernetes.io/metadata.name
+              operator: NotIn
+              values:
+                - kube-system
+                - flux-system
+                - kyverno
+                - longhorn-system
+                - monitoring