viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

novelapp: bump Keel policy patch -> all (track any upstream version)

Browse source 
Explicitly own the keel.sh/policy annotation in TF (was relying on the
Kyverno-stamped `patch` default). Set policy=all + trigger=poll +
pollSchedule, expand ignore_changes per KEEL_LIFECYCLE_V1 to cover
Keel-written runtime annotations (change-cause, update-time, revision,
match-tag).
This commit is contained in:
Viktor Barzin 2026-06-04 18:51:44 +00:00
parent 9cb609f21a
commit 6cec27f8dc
1 changed files with 14 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

17
stacks/novelapp/main.tf
View file

@ -89,13 +89,24 @@ resource "kubernetes_deployment" "novelapp" {
}
annotations = {
"reloader.stakater.com/auto" = "true"
# Override the Kyverno-stamped default (`patch`) with `all` so Keel picks
# up any new tag from mghee/novelapp. The `+()` anchor in the Kyverno
# ClusterPolicy preserves this explicit value; not in ignore_changes
# below so TF re-asserts it on every apply (otherwise the injector
# default would drift back in).
"keel.sh/policy" = "all"
"keel.sh/trigger" = "poll"
"keel.sh/pollSchedule" = "@every 1h"
}
}
lifecycle {
# DRIFT_WORKAROUND: CI pipeline owns image tag (kubectl set image from Woodpecker/GHA). Reviewed 2026-04-18.
ignore_changes = [
spec[0].template[0].spec[0].container[0].image,
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1: Kyverno admission webhook mutates dns_config with ndots=2
spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE — Keel manages tag updates
spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1: Kyverno admission webhook mutates dns_config with ndots=2
metadata[0].annotations["keel.sh/match-tag"], # Kyverno actively strips this legacy annotation
metadata[0].annotations["kubernetes.io/change-cause"], # Keel writes this on each auto-upgrade
metadata[0].annotations["deployment.kubernetes.io/revision"], # K8s increments this on every rollout
spec[0].template[0].metadata[0].annotations["keel.sh/update-time"], # KEEL_LIFECYCLE_V1 — Keel writes on update
]
}
spec {