fix(arc): set skipBackgroundRequests=false to clear Kyverno CRD default drift + correct kyverno CM comment - #17
Merged
Conversation
…lt drift + correct kyverno CM comment Close-out for the merged ARC/Kyverno PR #8. The Kyverno clusterpolicies.kyverno.io CRD sets rule-level skipBackgroundRequests to default: true. The arc policy's manifest omitted the field, so the API server defaulted it to true live -> the arc app stayed permanently OutOfSync AND the background rescan was disabled (defeating the policy's purpose of re-asserting the arm64 taint after node re-provisioning). ArgoCD SSA cannot clear a defaulted field, so only an explicit value in git fixes it durably. - kubernetes/arc/node-arm64-arch-taint.yaml: add skipBackgroundRequests: false to the taint-arm64-nodes rule. - helm/releases/kyverno/values.yaml: correct the stale comment block. The kyverno ConfigMap IS ArgoCD-managed (ArgoCD owns its data keys; the keep annotation only prevents deletion, not update), and the resourceFiltersExclude hook already drops [Node,*,*] at render time, so NO manual one-off ConfigMap patch is required. Remove the stale/wrong literal resourceFilters string.
There was a problem hiding this comment.
🟡 Changes recommended
The Kyverno guidance conflicts with the ARC README, which still prescribes an unnecessary ConfigMap patch.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Updates the ARC Kyverno policy to prevent default-field drift and corrects Kyverno ConfigMap guidance.
Changes:
- Sets
skipBackgroundRequests: falsefor the ARM taint policy. - Corrects the Kyverno ConfigMap management comment.
File summaries
| File | Summary |
|---|---|
kubernetes/arc/node-arm64-arch-taint.yaml |
Enables background policy rescans explicitly. |
helm/releases/kyverno/values.yaml |
Corrects ConfigMap management documentation. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+31
to
+33
| # the CM on prune — it does NOT stop ArgoCD from UPDATING its data. So once the | ||
| # `kyverno` app syncs, the live `resourceFilters` is already correct (no | ||
| # `[Node,*,*]`). No manual one-off `kubectl patch configmap kyverno` is needed. |
emmanuelbruno
deleted the
preservation/arc-kyverno-closeout-2026-09-15
branch
September 15, 2026 15:59
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Close-out for the merged ARC/Kyverno PR #8.
Root cause
The Kyverno
clusterpolicies.kyverno.ioCRD sets rule-levelskipBackgroundRequeststodefault: true. The arc policy's git manifest omitted the field, so the API server defaulted it totruelive — thearcArgoCD app stayed permanently OutOfSync AND the background rescan was disabled (defeating the policy's purpose of re-asserting thekubernetes.io/arch=arm64taint after node re-provisioning). ArgoCD SSA cannot clear a defaulted field, so only an explicit value in git fixes it durably.Changes
kubernetes/arc/node-arm64-arch-taint.yaml— addskipBackgroundRequests: falseto thetaint-arm64-nodesrule (sibling ofname, beforematch).match/other rule content preserved exactly.helm/releases/kyverno/values.yaml— fix the stale comment block nearconfig.resourceFiltersExclude:keepannotation only prevents deletion, not update).resourceFiltersExclude: ['[Node,*,*]']hook removes the standalone[Node,*,*]at Helm render time; the Kyverno ConfigMap IS ArgoCD-managed and itsresourceFiltersis already correct after sync; therefore NO manual one-off ConfigMap patch is required. The stale literal string is removed.config.resourceFiltersExcludeitself is unchanged.Validation
kubectl kustomize kubernetes/arc→ renderednode-arm64-arch-taintrule now containsskipBackgroundRequests: false.arcapp to go Synced + Healthy (no longer OutOfSync) and the live rule to showskipBackgroundRequests: false. No manual CM patch applied (none needed).