jakman85andClaude Opus 4.8
c6331c84bf
Kyverno HelmRelease install failed at Helm templating: config.webhooks was a
LIST [{failurePolicy, namespaceSelector}], but the kyverno 3.3.9 chart expects
config.webhooks to be a MAP (webhooks.namespaceSelector) — the chart helper reads
.namespaceSelector off the value directly ('can't evaluate field namespaceSelector
in type []interface {}'). Also, failurePolicy is not a per-webhook field here; the
chart's global switch is config.forceFailurePolicyIgnore.enabled (bool).
Fix: config.webhooks -> map with namespaceSelector (system+platform excludes);
add config.forceFailurePolicyIgnore.enabled = ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}.
Renamed the cluster-var KYVERNO_WEBHOOK_FAILURE_POLICY (Fail/Ignore) ->
KYVERNO_FORCE_FAILURE_POLICY_IGNORE (false base / true dev). Verified with
helm template (renders 73 objects, no error); gate PASS.
Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
67 lines
2.3 KiB
YAML
67 lines
2.3 KiB
YAML
# SCAFFOLDING for a later phase (Phase 2, task T-2.7) -- NOT applied in Phase 0
|
|
# (no cluster exists yet). Installs Kyverno so the SAME L0 policies run in-cluster
|
|
# as an admission controller (defense in depth per docs/07, ADR-0011). Flux
|
|
# HelmRelease skeleton; chart/app versions are pinned and bumped via the update path.
|
|
---
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: kyverno
|
|
namespace: kyverno
|
|
spec:
|
|
interval: 24h
|
|
url: https://kyverno.github.io/kyverno/
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: kyverno
|
|
namespace: kyverno
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: kyverno
|
|
version: "3.3.x" # pin to the exact chart the operator vendors
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: kyverno
|
|
namespace: kyverno
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
# Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod
|
|
# restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap.
|
|
admissionController:
|
|
replicas: ${KYVERNO_ADMISSION_REPLICAS}
|
|
backgroundController:
|
|
enabled: true # needed for generate (default-deny baseline) + sync
|
|
reportsController:
|
|
enabled: true
|
|
cleanupController:
|
|
enabled: true
|
|
# config.webhooks is a MAP in the Kyverno chart (NOT a list — a list breaks the chart's
|
|
# webhook helper). namespaceSelector excludes system + platform namespaces at the webhook layer
|
|
# (belt-and-suspenders: the policies already scope to app-namespace=true). forceFailurePolicyIgnore
|
|
# is the chart's global fail-open switch — a cluster-vars knob: dev enables it (a cold/unhealthy
|
|
# Kyverno can't brick admission during bootstrap); prod disables it (fail-closed per
|
|
# coordination-protocol.md #8).
|
|
config:
|
|
forceFailurePolicyIgnore:
|
|
enabled: ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}
|
|
webhooks:
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- flux-system
|
|
- kyverno
|
|
- longhorn-system
|
|
- monitoring
|