From 118eb0817a5e555d4c88f8e378eadcc84739864d Mon Sep 17 00:00:00 2001 From: Nikolai Emil Damm Date: Tue, 20 Oct 2026 17:58:23 +0200 Subject: [PATCH] feat(kyverno): unregister the classic auto-vpa ClusterPolicy Step 1 of the shared catalog's two-reconcile move to the auto-vpa GeneratingPolicy form (devantler-tech/kyverno-policies#1). The classic policy's removal deletes the VPAs it generated; the GeneratingPolicy form is registered in a separate later revision so the two never run at once. The file stays, still tested, as the rollback form. Co-Authored-By: Claude Opus 5.5 --- .../infrastructure/cluster-policies/kustomization.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/k8s/bases/infrastructure/cluster-policies/kustomization.yaml b/k8s/bases/infrastructure/cluster-policies/kustomization.yaml index 3f7c7afe89..e143931c6c 100644 --- a/k8s/bases/infrastructure/cluster-policies/kustomization.yaml +++ b/k8s/bases/infrastructure/cluster-policies/kustomization.yaml @@ -8,7 +8,13 @@ resources: - best-practices/add-recommended-labels.yaml - best-practices/add-resource-defaults.yaml - best-practices/add-security-context.yaml - - best-practices/auto-vpa.yaml + # best-practices/auto-vpa.yaml is deliberately NOT registered: it is step 1 + # of the shared catalog's two-reconcile move to its GeneratingPolicy form + # (devantler-tech/kyverno-policies#1). Removing the classic policy deletes + # the VPAs it generated; the GeneratingPolicy form is registered in a later + # revision, once no `generate.kyverno.io/policy-name=auto-vpa` VPA remains, + # so the two forms never run at once. The file stays, still tested, as the + # rollback form until that move is complete. - best-practices/audit-privileged-rbac.yaml - best-practices/disable-default-sa-automount.yaml - best-practices/disallow-latest-tag.yaml