From 51838a4ec7ee60735b88964c2a46ec33bc92d301 Mon Sep 17 00:00:00 2001 From: Viktor Barzin Date: Sun, 21 Jun 2026 17:21:38 +0000 Subject: [PATCH] =?UTF-8?q?kyverno:=203.6.1=20->=203.8.1=20(app=201.16=20-?= =?UTF-8?q?>=201.18.1)=20=E2=80=94=20clears=20the=20k8s-1.35=20compat-gate?= =?UTF-8?q?=20block?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit kyverno v1.16 supports k8s <=1.34, so it was one of the two addons blocking the autonomous 1.35 upgrade (compat gate, nightly). v1.18 supports 1.35. Stepped one minor at a time per the kyverno upgrade guide (per-minor CRD notes): 3.6.1 (1.16) -> 3.7.2 (1.17.2) -> 3.8.1 (1.18.1), each hop applied + verified supervised. atomic=true (auto-rollback on a failed rollout) + forceFailurePolicyIgnore (admissions stay open mid-roll) kept it safe. Values schema confirmed compatible across 3.6->3.8 (forceFailurePolicyIgnore still under features:). Verified after each hop: all 17 ClusterPolicies stayed Ready, admission controller 2/2, no destroys/replaces in plan. Final 1.18.1: images v1.18.1, mutating webhook live (server-side dry-run injects ndots:2 in a non-excluded ns). compat-gate vs 1.35.6 now lists ONLY external-secrets (kyverno cleared). ESO 0.12->2.x (v1beta1->v1, 73 files) is the last remaining 1.35 blocker — to be planned. Co-Authored-By: Claude Opus 4.8 --- stacks/kyverno/modules/kyverno/main.tf | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/stacks/kyverno/modules/kyverno/main.tf b/stacks/kyverno/modules/kyverno/main.tf index 3c77d653..e199b296 100644 --- a/stacks/kyverno/modules/kyverno/main.tf +++ b/stacks/kyverno/modules/kyverno/main.tf @@ -21,7 +21,13 @@ resource "helm_release" "kyverno" { repository = "https://kyverno.github.io/kyverno/" chart = "kyverno" - version = "3.6.1" + # Stepped upgrade to clear the k8s-1.35 compat-gate block (kyverno <=1.34 -> 1.35). + # 3.6.1 (app 1.16) -> 3.7.2 (1.17) -> 3.8.1 (1.18, supports k8s 1.35), one minor at + # a time per the kyverno upgrade guide (per-minor CRD notes). atomic=true rolls back + # a failed rollout; forceFailurePolicyIgnore keeps admissions open if the webhook is + # mid-roll. Each hop verified: 17 ClusterPolicies stay Ready + webhook responds. + # 3.6.1->3.7.2 done 2026-06-21 (clean). Now 3.7.2 (1.17.2) -> 3.8.1 (1.18.1). + version = "3.8.1" values = [yamlencode({ # When Kyverno is unavailable, allow pod creation to proceed without