viktor/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

kyverno: add mutateExistingOnPolicyUpdate=true so existing workloads get annotated

Browse source 
Before this, the inject-keel-annotations policy only fired on admission
events. Workloads that existed BEFORE their namespace got labeled
keel.sh/enrolled=true never received the annotation, so Keel didn't
watch them. Live state was 30 of 226 workloads auto-updating.

With mutateExistingOnPolicyUpdate=true and the required mutate.targets
block, Kyverno's BackgroundScan controller applies the mutate to
existing matching Deployments/StatefulSets/DaemonSets on policy update.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
Viktor Barzin 2026-05-16 23:27:27 +00:00
parent 8b9727ac3e
commit bc714755ea
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
stacks/kyverno/modules/kyverno/keel-annotations.tf
View file

@ -30,7 +30,14 @@ resource "kubernetes_manifest" "policy_inject_keel_annotations" {
}
}
spec = {
background = true
# Retroactively mutate workloads that existed BEFORE their namespace
# got the keel.sh/enrolled=true label. Without this, Kyverno only
# fires on admission events, so old workloads stay unannotated and
# Keel doesn't watch them. With this flag, Kyverno's BackgroundScan
# controller applies the mutate on existing matching resources when
# the policy is created or updated.
mutateExistingOnPolicyUpdate = true
background = true
rules = [{
name = "add-keel-annotations"
match = {
@ -69,6 +76,13 @@ resource "kubernetes_manifest" "policy_inject_keel_annotations" {
]
}
mutate = {
# Required when mutateExistingOnPolicyUpdate=true — tells the
# background controller which existing resources to mutate.
targets = [
{ apiVersion = "apps/v1", kind = "Deployment" },
{ apiVersion = "apps/v1", kind = "StatefulSet" },
{ apiVersion = "apps/v1", kind = "DaemonSet" },
]
patchStrategicMerge = {
metadata = {
annotations = {