Viktor Barzin 629fe24305 kyverno: exclude calico-system from inject-keel-annotations ... Stop the hourly Keel-vs-tigera-operator fight loop on calico-node DaemonSet (v3.26.5 ↔ v3.26.1). Live: re-annotated 4 calico-system workloads with keel.sh/policy=never; TF: added calico-system to the namespaces exclude list so any future mutate run won't re-inject. The previous calico unenrollment (label removal from namespace) wasn't enough — once Kyverno had stamped the policy=patch annotation on the Deployments/DaemonSets, removing the namespace label didn't strip the annotation, so Keel kept watching them. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>		2026-05-16 22:58:20 +00:00
..
kyverno	kyverno: exclude calico-system from inject-keel-annotations	2026-05-16 22:58:20 +00:00