jakman85andClaude Opus 4.8
22db5fdb63
- HR chart 3.3.x -> 3.9.x (Kyverno v1.13.6 -> v1.19.0). - crds.install:false + CRDs pre-applied server-side (5.7 MB bundle exceeds kubectl's 256 KB annotation limit; Helm client-side apply would stall the platform Kustomization, kps-style). - CLI lockstep (ci/conformance/devcontainer versions.env + run-l0.sh default) -> 1.19.0. Pre-verified: v1.19.0 kyverno CLI passes the L0 suite 17/17 with the existing test format. - Policies are kyverno.io/v1 ClusterPolicy (stable API, unchanged in v1.19). Co-Authored-By: Claude Opus 4.8 <[email protected]>
100 lines
4.4 KiB
YAML
100 lines
4.4 KiB
YAML
# SCAFFOLDING for a later phase (Phase 2, task T-2.7) -- NOT applied in Phase 0
|
|
# (no cluster exists yet). Installs Kyverno so the SAME L0 policies run in-cluster
|
|
# as an admission controller (defense in depth per docs/07, ADR-0011). Flux
|
|
# HelmRelease skeleton; chart/app versions are pinned and bumped via the update path.
|
|
---
|
|
apiVersion: source.toolkit.fluxcd.io/v1
|
|
kind: HelmRepository
|
|
metadata:
|
|
name: kyverno
|
|
namespace: kyverno
|
|
spec:
|
|
interval: 24h
|
|
url: https://kyverno.github.io/kyverno/
|
|
---
|
|
apiVersion: helm.toolkit.fluxcd.io/v2
|
|
kind: HelmRelease
|
|
metadata:
|
|
name: kyverno
|
|
namespace: kyverno
|
|
spec:
|
|
interval: 1h
|
|
chart:
|
|
spec:
|
|
chart: kyverno
|
|
version: "3.9.x" # Kyverno v1.19.x (k8s-1.36-era stay-current, from 3.3/v1.13). Renovate maintains
|
|
sourceRef:
|
|
kind: HelmRepository
|
|
name: kyverno
|
|
namespace: kyverno
|
|
install:
|
|
remediation:
|
|
retries: 3
|
|
upgrade:
|
|
remediation:
|
|
retries: 3
|
|
values:
|
|
# CRD management is OFF the Helm release (mirror velero): the Kyverno CRD bundle is ~5.7 MB, far
|
|
# past kubectl's 256 KB last-applied-configuration annotation limit, so Helm's client-side apply
|
|
# fails ("metadata.annotations: Too long") and STALLS the upgrade → the platform Kustomization
|
|
# would block (the kps-cascade failure mode). CRDs are instead pre-applied server-side on each
|
|
# chart bump: `helm template kyverno/kyverno --version <v> --include-crds | kubectl apply
|
|
# --server-side --force-conflicts -f -` (22 CRDs at v1.19). Trade-off: CRD schema upgrades become a
|
|
# manual/Renovate step, same as velero's upgradeCRDs:false.
|
|
crds:
|
|
install: false
|
|
# The chart's cleanup Jobs default to bitnami/kubectl:1.30.2, which Bitnami PURGED from Docker Hub
|
|
# (2024 catalog change) → the jobs ImagePullBackOff. policyReportsCleanup runs as a Helm
|
|
# post-upgrade HOOK, so its failure STALLS every helm upgrade (5m timeout → HelmRelease not-Ready →
|
|
# platform Kustomization blocks). Point both cleanup images at Bitnami's relocated `bitnamilegacy`
|
|
# mirror — the identical image (has /bin/bash + awk/wc/xargs + kubectl the jobs need). Pinned tag.
|
|
policyReportsCleanup:
|
|
image:
|
|
repository: bitnamilegacy/kubectl
|
|
webhooksCleanup:
|
|
image:
|
|
repository: bitnamilegacy/kubectl
|
|
# Admission controller replicas — cluster-vars knob (prod 3 / dev 1). HA so a single pod
|
|
# restart cannot open an enforcement gap; dev drops to 1 to save RAM during bootstrap.
|
|
admissionController:
|
|
replicas: ${KYVERNO_ADMISSION_REPLICAS}
|
|
# Resources — chart default (limits.memory 384Mi / requests.cpu 100m,memory 128Mi) starves this
|
|
# latency-sensitive, fail-closed webhook: under node CPU contention the 100m request gave too few
|
|
# CFS shares, so client-go calls hit "context deadline exceeded" → leader-election lease renewal
|
|
# timed out → "leadership lost, stopped leading" → server closed (exit 255, NOT OOM: live usage
|
|
# was ~65Mi/7m). Raise the CPU REQUEST for scheduling headroom and keep NO CPU limit (a limit would
|
|
# reintroduce throttling and make lease-renewal timeouts worse). Memory bumped for headroom only.
|
|
container:
|
|
resources:
|
|
requests:
|
|
cpu: 250m
|
|
memory: 256Mi
|
|
limits:
|
|
memory: 512Mi
|
|
backgroundController:
|
|
enabled: true # needed for generate (default-deny baseline) + sync
|
|
reportsController:
|
|
enabled: true
|
|
cleanupController:
|
|
enabled: true
|
|
# config.webhooks is a MAP in the Kyverno chart (NOT a list — a list breaks the chart's
|
|
# webhook helper). namespaceSelector excludes system + platform namespaces at the webhook layer
|
|
# (belt-and-suspenders: the policies already scope to app-namespace=true). forceFailurePolicyIgnore
|
|
# is the chart's global fail-open switch — a cluster-vars knob: dev enables it (a cold/unhealthy
|
|
# Kyverno can't brick admission during bootstrap); prod disables it (fail-closed per
|
|
# coordination-protocol.md #8).
|
|
config:
|
|
forceFailurePolicyIgnore:
|
|
enabled: ${KYVERNO_FORCE_FAILURE_POLICY_IGNORE}
|
|
webhooks:
|
|
namespaceSelector:
|
|
matchExpressions:
|
|
- key: kubernetes.io/metadata.name
|
|
operator: NotIn
|
|
values:
|
|
- kube-system
|
|
- flux-system
|
|
- kyverno
|
|
- longhorn-system
|
|
- monitoring
|