51838a4ec7
All checks were successful
ci/woodpecker/push/default Pipeline was successful
kyverno v1.16 supports k8s <=1.34, so it was one of the two addons blocking the autonomous 1.35 upgrade (compat gate, nightly). v1.18 supports 1.35. Stepped one minor at a time per the kyverno upgrade guide (per-minor CRD notes): 3.6.1 (1.16) -> 3.7.2 (1.17.2) -> 3.8.1 (1.18.1), each hop applied + verified supervised. atomic=true (auto-rollback on a failed rollout) + forceFailurePolicyIgnore (admissions stay open mid-roll) kept it safe. Values schema confirmed compatible across 3.6->3.8 (forceFailurePolicyIgnore still under features:). Verified after each hop: all 17 ClusterPolicies stayed Ready, admission controller 2/2, no destroys/replaces in plan. Final 1.18.1: images v1.18.1, mutating webhook live (server-side dry-run injects ndots:2 in a non-excluded ns). compat-gate vs 1.35.6 now lists ONLY external-secrets (kyverno cleared). ESO 0.12->2.x (v1beta1->v1, 73 files) is the last remaining 1.35 blocker — to be planned. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| modules/kyverno | ||
| main.tf | ||
| secrets | ||
| terragrunt.hcl | ||