kyverno(kube): fix deployment

kubernetes/system/flux/kustomization.yaml

@@ -14,3 +14,4 @@ resources:
   - openclaw-operator.yaml
   - openclaw.yaml
   - kyverno.yaml
+  - kyverno-policies.yaml

kubernetes/system/flux/kyverno-policies.yaml

@@ -0,0 +1,19 @@
+---
+# Flux Kustomization for Kyverno ClusterPolicies.
+# dependsOn "kyverno" (the controller + CRDs) so the kyverno.io/v2 CRD exists
+# before Flux dry-runs the ClusterPolicy. Without this split, Flux fails the
+# whole Kustomization at dry-run ("no matches for kind ClusterPolicy").
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno-policies
+  namespace: flux-system
+spec:
+  interval: 5m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/kyverno-policies
+  dependsOn:
+    - name: kyverno

kubernetes/system/kyverno-policies/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+# Kyverno ClusterPolicies.
+# Applied by the Flux Kustomization "kyverno-policies" which dependsOn "kyverno"
+# (the controller + CRDs). This split is required because Flux dry-runs every
+# resource in a Kustomization before applying any — the ClusterPolicy references
+# the kyverno.io/v2 CRD that only exists once the kyverno HelmRelease installs.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Toggleable emergency relief: strips resources.requests.cpu cluster-wide.
+  # See the file header for the toggle (failurePolicy Ignore/Never) commands.
+  - policy-strip-cpu-requests.yaml

kubernetes/system/kyverno/kustomization.yaml

@@ -1,4 +1,11 @@
 ---
+# Kyverno controller + CRDs only.
+# The ClusterPolicy lives in a SEPARATE directory (kubernetes/system/kyverno-policies)
+# applied by a SEPARATE Flux Kustomization (kyverno-policies) with dependsOn:
+# kyverno. This split is required because Flux dry-runs every resource in a
+# Kustomization before applying any of them — the ClusterPolicy references the
+# kyverno.io/v2 CRD, which does not exist until this HelmRelease installs it, so
+# bundling them together makes the whole Kustomization fail at dry-run.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kyverno
@@ -6,8 +13,5 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release.yaml
-  # ClusterPolicy that strips CPU requests for emergency relief (toggleable).
-  # See policy-strip-cpu-requests.yaml header for the toggle instructions.
-  - policy-strip-cpu-requests.yaml
 configurations:
   - kustomizeconfig.yaml