Viktor Barzin
1082cba0fb
## Resolves code-e2dp (Kyverno TF apply blocked)
Root cause: terraform-provider-kubernetes v3.1.0 panics on plan/refresh of
kubernetes_manifest resources holding Kyverno ClusterPolicy CRDs (large
CEL/foreach schemas). Workaround: swap to gavinbunney/kubectl_manifest which
treats manifests as opaque YAML strings.
## Migration mechanics
- Root terragrunt.hcl: added gavinbunney/kubectl provider declaration so all
stacks get it generated in providers.tf.
- stacks/kyverno/modules/kyverno/versions.tf (new): module-level provider source
declaration (required for kubectl_manifest in a child module).
- Converted 17 kubernetes_manifest resources across 7 files to kubectl_manifest
with yaml_body = yamlencode({...}). depends_on chains preserved.
- terraform state rm for all 17 old kubernetes_manifest entries.
- stacks/kyverno/imports.tf (new): TF 1.5+ import blocks mapping each
kubectl_manifest to its live cluster resource by apiVersion//Kind//name ID.
- One resource (policy_inject_keel_annotations) needed kubectl delete + recreate
because the kubectl provider couldn't patch it cleanly (resourceVersion=0
invalid for update — gotcha when adopting a resource previously
kubernetes_manifest-owned).
## W1.4 — security policies Audit → Enforce (LIVE)
Three policies flipped: deny-privileged-containers, deny-host-namespaces,
restrict-sys-admin. Verified live via kubectl. failurePolicy=Ignore preserved.
## Shared exclude list (35 namespaces)
local.security_policy_exclude_namespaces in security-policies.tf.
- 31 critical from memory id=1970 (Keel rollout list)
- + frigate (camera HW transcoding needs host access)
- + kured (privileged DaemonSet for node reboots)
- + default (etcd backup/defrag CronJobs use hostNetwork)
- + changedetection (uses SYS_ADMIN for chromium sandbox)
## W1.5 — require-trusted-registries stays Audit
Pattern */* allows anything-with-a-slash; Enforce would be a no-op for supply
chain. Tracked under beads code-8ywc as follow-up.
## TF import-blocks
The imports.tf file should be removed in a follow-up cleanup commit once
verified — TF doesn't auto-clean these.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Closes: code-e2dp
72 lines
2.5 KiB
HCL
72 lines
2.5 KiB
HCL
# Import existing live Kyverno resources into kubectl_manifest state.
|
|
# Created during code-e2dp fix (kubernetes_manifest → kubectl_manifest swap).
|
|
# Once applied successfully, these import blocks can be deleted in a cleanup commit.
|
|
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.cleanup_failed_pods
|
|
id = "kyverno.io/v2beta1//ClusterCleanupPolicy//cleanup-failed-pods"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.generate_limitrange_by_tier
|
|
id = "kyverno.io/v1//ClusterPolicy//generate-limitrange-by-tier"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.generate_resourcequota_by_tier
|
|
id = "kyverno.io/v1//ClusterPolicy//generate-resourcequota-by-tier"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.inject_dependency_init_containers
|
|
id = "kyverno.io/v1//ClusterPolicy//inject-dependency-init-containers"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.mutate_gpu_priority
|
|
id = "kyverno.io/v1//ClusterPolicy//mutate-gpu-priority"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.mutate_ndots
|
|
id = "kyverno.io/v1//ClusterPolicy//mutate-ndots"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.mutate_priority_from_tier
|
|
id = "kyverno.io/v1//ClusterPolicy//mutate-priority-from-tier"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.mutate_strip_cpu_limits
|
|
id = "kyverno.io/v1//ClusterPolicy//mutate-strip-cpu-limits"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.mutate_tier_from_namespace
|
|
id = "kyverno.io/v1//ClusterPolicy//mutate-tier-from-namespace"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.policy_deny_host_namespaces
|
|
id = "kyverno.io/v1//ClusterPolicy//deny-host-namespaces"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.policy_deny_privileged
|
|
id = "kyverno.io/v1//ClusterPolicy//deny-privileged-containers"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.policy_inject_keel_annotations
|
|
id = "kyverno.io/v1//ClusterPolicy//inject-keel-annotations"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.policy_require_trusted_registries
|
|
id = "kyverno.io/v1//ClusterPolicy//require-trusted-registries"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.policy_restrict_capabilities
|
|
id = "kyverno.io/v1//ClusterPolicy//restrict-sys-admin"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.policy_set_image_pull_policy
|
|
id = "kyverno.io/v1//ClusterPolicy//set-image-pull-policy"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.sync_registry_credentials
|
|
id = "kyverno.io/v1//ClusterPolicy//sync-registry-credentials"
|
|
}
|
|
import {
|
|
to = module.kyverno.kubectl_manifest.sync_tls_secret
|
|
id = "kyverno.io/v1//ClusterPolicy//sync-tls-secret"
|
|
}
|