From afb0f397c255d4f84f448754a0bc760dceeb5a17 Mon Sep 17 00:00:00 2001 From: Emmanuel Bruno Date: Tue, 15 Sep 2026 17:54:58 +0200 Subject: [PATCH] fix(arc): set skipBackgroundRequests=false to clear Kyverno CRD default drift + correct kyverno CM comment Close-out for the merged ARC/Kyverno PR #8. The Kyverno clusterpolicies.kyverno.io CRD sets rule-level skipBackgroundRequests to default: true. The arc policy's manifest omitted the field, so the API server defaulted it to true live -> the arc app stayed permanently OutOfSync AND the background rescan was disabled (defeating the policy's purpose of re-asserting the arm64 taint after node re-provisioning). ArgoCD SSA cannot clear a defaulted field, so only an explicit value in git fixes it durably. - kubernetes/arc/node-arm64-arch-taint.yaml: add skipBackgroundRequests: false to the taint-arm64-nodes rule. - helm/releases/kyverno/values.yaml: correct the stale comment block. The kyverno ConfigMap IS ArgoCD-managed (ArgoCD owns its data keys; the keep annotation only prevents deletion, not update), and the resourceFiltersExclude hook already drops [Node,*,*] at render time, so NO manual one-off ConfigMap patch is required. Remove the stale/wrong literal resourceFilters string. --- helm/releases/kyverno/values.yaml | 21 +++++++++------------ kubernetes/arc/node-arm64-arch-taint.yaml | 1 + 2 files changed, 10 insertions(+), 12 deletions(-) diff --git a/helm/releases/kyverno/values.yaml b/helm/releases/kyverno/values.yaml index 03a252a..a232bce 100644 --- a/helm/releases/kyverno/values.yaml +++ b/helm/releases/kyverno/values.yaml @@ -21,16 +21,13 @@ config: resourceFiltersExclude: - '[Node,*,*]' -# --- One-off live-CM patch (post-merge, manual — NOT part of this diff) -------- -# The live `kyverno/kyverno` ConfigMap is annotated `helm.sh/resource-policy: -# keep` and is NOT managed by ArgoCD/Helm, so the values change above only takes -# effect on a fresh install / rebuild. To apply it to the running cluster, run -# this single sanctioned data-level patch (read-only-verify the mutating webhook -# catch-all on Node first: apiGroups `*`, resources `*/*`, ops CREATE/UPDATE on -# `kyverno-policy-mutating-webhook-cfg`), substituting the exact INTENDED string: +# --- No manual ConfigMap patch required --------------------------------------- +# The `resourceFiltersExclude` hook above removes the standalone `[Node,*,*]` +# entry at Helm render time (deep-merged into the chart default), keeping +# `[Node/?*,*,*]` so Node *subresources* (status) stay filtered. # -# kubectl patch configmap kyverno -n kyverno --type merge -p '{"data":{"resourceFilters":""}}' -# -# INTENDED resourceFilters (current live value minus the standalone `[Node,*,*]`; -# `[Node/?*,*,*]` kept), single line: -# [*/*,kyverno,*] [Event,*,*] [*/events,*,*] [APIService,*,*] [APIServiceGroup,*,*] [TokenReview,*,*] [SubjectAccessReview,*,*] [SelfSubjectAccessReview,*,*] [RuntimeClass,*,*] [ClusterRuntimeClass,*,*] [ConstrainedTemplatePolicy,*,*] [ClusterConstrainedTemplatePolicy,*,*] [ClusterPolicy,*,*] [ClusterPolicyException,*,*] [BackgroundScanReport,*,*] [ClusterBackgroundScanReport,*,*] [ClusterAdmissionReport,*,*] [AdmissionReport,*,*] [kyverno.io/*,*,*] [updaterequests,*,*] [kyverno.io/updaterequests,*,*] [namespaceinitializers,*,*] [namespaceinitializers.cert-manager.io,*,*] [Node/?*,*,*] +# The live `kyverno` ConfigMap IS ArgoCD-managed: ArgoCD owns its `data` keys. +# The `helm.sh/resource-policy: keep` annotation only stops ArgoCD from DELETING +# the CM on prune — it does NOT stop ArgoCD from UPDATING its data. So once the +# `kyverno` app syncs, the live `resourceFilters` is already correct (no +# `[Node,*,*]`). No manual one-off `kubectl patch configmap kyverno` is needed. diff --git a/kubernetes/arc/node-arm64-arch-taint.yaml b/kubernetes/arc/node-arm64-arch-taint.yaml index bd306fe..62c18e4 100644 --- a/kubernetes/arc/node-arm64-arch-taint.yaml +++ b/kubernetes/arc/node-arm64-arch-taint.yaml @@ -21,6 +21,7 @@ spec: emitWarning: false rules: - name: taint-arm64-nodes + skipBackgroundRequests: false match: any: - resources: