# After an upgrade to Kyverno 1.20, Argo CD reports a legacy ClusterPolicy as out of sync on every reconcile, though its manifest never changed. Why?

Kyverno, Hard (Expert), Policies. https://k8wiz.com/uquiz/after-an-upgrade-to-kyverno-120-argo-cd-reports-a-legacy-clusterpolicy-as-out-of-sync-on-every-reconcile-though-its-manifest-nev

- A. Kyverno marks the policy NotReady, which Argo CD reports as drift
- B. Kyverno denies updates to legacy policy kinds, even an unchanged re-apply
- C. Helm pruned the legacy CRD, so the apply targets a missing kind
- D. Kyverno rewrites the stored object to the policies.kyverno.io group

**Answer:** Kyverno denies updates to legacy policy kinds, even an unchanged re-apply

**Explanation:** In 1.20 Kyverno denies every create and almost every update to the five legacy policy kinds, including a re-apply of an unchanged manifest, which 1.19 silently accepted. Each reconcile is rejected, so the app never syncs. The legacy CRDs carry helm.sh/resource-policy: keep and are not pruned; the fix is to migrate the policy and remove the legacy manifest from Git.