security(kyverno): restore background coverage of kube-system, kube-public and kube-node-lease #4234

🤖 Generated by the Agentic Engineer

Evidence

• security(kyverno): system namespaces have had no Kyverno policy coverage since June #4228 found that no Kyverno policy has evaluated anything in kube-system, kube-public, kube-node-lease or kyverno since June, because the chart's default resource filters exclude those namespaces and background scans honour the filters.
• With fix(kyverno): exclude the system namespaces from auto-vpa explicitly #4232 merged, every background policy that generates or mutates existing resources already excludes kube-system, kube-public and kube-node-lease explicitly (add-default-deny, add-default-limitrange, add-ns-quota, disable-default-sa-automount, auto-vpa; the Hetzner retrofits are scoped to longhorn-system or to cluster-scoped Nodes).
• The kyverno namespace is different: add-default-deny and add-default-limitrange do not exclude it. Dropping its filter would make Kyverno generate a default-deny NetworkPolicy in its own namespace and a default-limitrange that collides with the Flux-owned one of the same name. It stays filtered in this slice.
• Admission is unchanged for kube-system (the webhooks' namespaceSelector already skips it). kube-public and kube-node-lease hold only ConfigMaps and node Leases; every Enforce rule on prod matches Pods or GitHub team objects, so none newly blocks anything there.

Audience and problem

The maintainer reads the compliance aggregate as the cluster's policy state, but it silently leaves out the namespaces that run the cluster's core workloads.

Hypothesis

Dropping the three Kubernetes system namespaces from the resource filters gives them current background reports, with no new admission effect and no generated or mutated resources there.

Success signal

A policy matching a resource in kube-system, kube-public or kube-node-lease produces a current report within two scan intervals (proved on a throwaway cluster in CI), and the reports controller's memory stays within its limit for a week after rollout.

Smallest useful change

Remove the three [*/*,<namespace>,*] entries through resourceFiltersExclude, keep kyverno filtered, invert the throwaway-cluster proof so it requires a report in the three namespaces and none in kyverno, and update docs/policy-reports.md.

Acceptance criteria

• The CI proof shows a current report for a matching resource in each of the three namespaces and none in kyverno.
• No generate or mutate-existing policy acts in the three namespaces.
• The docs describe which namespaces Kyverno covers and why kyverno is still excluded.