Kyverno
Hard
Policies
After an upgrade to Kyverno 1.20, Argo CD reports a legacy ClusterPolicy as out of sync on every reconcile, though its manifest never changed. Why?
Select your answer:
Show answer and explanation
Answer: Kyverno denies updates to legacy policy kinds, even an unchanged re-apply
Explanation
In 1.20 Kyverno denies every create and almost every update to the five legacy policy kinds, including a re-apply of an unchanged manifest, which 1.19 silently accepted. Each reconcile is rejected, so the app never syncs. The legacy CRDs carry helm.sh/resource-policy: keep and are not pruned; the fix is to migrate the policy and remove the legacy manifest from Git.
More hard Kyverno questions
- What is the purpose of the 'context' field in a Kyverno policy?
- What is the purpose of the 'foreach' field in a Kyverno rule?
- Which of the following is NOT a component of the Kyverno architecture?
- What is the purpose of the 'kyverno.io/updateToken' annotation in a generated resource?
- Which of the following is NOT a valid source for context variables in Kyverno?
- What is the purpose of the 'kyverno.io/last-applied-policy' annotation?