kyverno: 3.6.1 -> 3.8.1 (app 1.16 -> 1.18.1) — clears the k8s-1.35 compat-gate block

kyverno v1.16 supports k8s <=1.34, so it was one of the two addons blocking the
autonomous 1.35 upgrade (compat gate, nightly). v1.18 supports 1.35.

Stepped one minor at a time per the kyverno upgrade guide (per-minor CRD notes):
3.6.1 (1.16) -> 3.7.2 (1.17.2) -> 3.8.1 (1.18.1), each hop applied + verified
supervised. atomic=true (auto-rollback on a failed rollout) + forceFailurePolicyIgnore
(admissions stay open mid-roll) kept it safe. Values schema confirmed compatible
across 3.6->3.8 (forceFailurePolicyIgnore still under features:).

Verified after each hop: all 17 ClusterPolicies stayed Ready, admission controller
2/2, no destroys/replaces in plan. Final 1.18.1: images v1.18.1, mutating webhook
live (server-side dry-run injects ndots:2 in a non-excluded ns). compat-gate vs
1.35.6 now lists ONLY external-secrets (kyverno cleared). ESO 0.12->2.x
(v1beta1->v1, 73 files) is the last remaining 1.35 blocker — to be planned.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/kyverno/modules/kyverno/main.tf

@@ -21,7 +21,13 @@ resource "helm_release" "kyverno" {
 
   repository = "https://kyverno.github.io/kyverno/"
   chart      = "kyverno"
-  version    = "3.6.1"
+  # Stepped upgrade to clear the k8s-1.35 compat-gate block (kyverno <=1.34 -> 1.35).
+  # 3.6.1 (app 1.16) -> 3.7.2 (1.17) -> 3.8.1 (1.18, supports k8s 1.35), one minor at
+  # a time per the kyverno upgrade guide (per-minor CRD notes). atomic=true rolls back
+  # a failed rollout; forceFailurePolicyIgnore keeps admissions open if the webhook is
+  # mid-roll. Each hop verified: 17 ClusterPolicies stay Ready + webhook responds.
+  # 3.6.1->3.7.2 done 2026-06-21 (clean). Now 3.7.2 (1.17.2) -> 3.8.1 (1.18.1).
+  version = "3.8.1"
 
   values = [yamlencode({
     # When Kyverno is unavailable, allow pod creation to proceed without