From 26dd59845f4340d6c9b762cbeac3439d6ac08701 Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Wed, 9 Sep 2026 22:20:59 +0200
Subject: [PATCH] kyverno(kube): fix deployment

---
 kubernetes/system/flux/kustomization.yaml     |  1 +
 kubernetes/system/flux/kyverno-policies.yaml  | 19 +++++++++++++++++++
 .../kyverno-policies/kustomization.yaml       | 12 ++++++++++++
 .../policy-strip-cpu-requests.yaml            |  0
 kubernetes/system/kyverno/kustomization.yaml  | 10 +++++++---
 5 files changed, 39 insertions(+), 3 deletions(-)
 create mode 100644 kubernetes/system/flux/kyverno-policies.yaml
 create mode 100644 kubernetes/system/kyverno-policies/kustomization.yaml
 rename kubernetes/system/{kyverno => kyverno-policies}/policy-strip-cpu-requests.yaml (100%)

diff --git a/kubernetes/system/flux/kustomization.yaml b/kubernetes/system/flux/kustomization.yaml
index 69ac2cc..368472f 100644
--- a/kubernetes/system/flux/kustomization.yaml
+++ b/kubernetes/system/flux/kustomization.yaml
@@ -14,3 +14,4 @@ resources:
   - openclaw-operator.yaml
   - openclaw.yaml
   - kyverno.yaml
+  - kyverno-policies.yaml
diff --git a/kubernetes/system/flux/kyverno-policies.yaml b/kubernetes/system/flux/kyverno-policies.yaml
new file mode 100644
index 0000000..3a87e13
--- /dev/null
+++ b/kubernetes/system/flux/kyverno-policies.yaml
@@ -0,0 +1,19 @@
+---
+# Flux Kustomization for Kyverno ClusterPolicies.
+# dependsOn "kyverno" (the controller + CRDs) so the kyverno.io/v2 CRD exists
+# before Flux dry-runs the ClusterPolicy. Without this split, Flux fails the
+# whole Kustomization at dry-run ("no matches for kind ClusterPolicy").
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno-policies
+  namespace: flux-system
+spec:
+  interval: 5m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/kyverno-policies
+  dependsOn:
+    - name: kyverno
diff --git a/kubernetes/system/kyverno-policies/kustomization.yaml b/kubernetes/system/kyverno-policies/kustomization.yaml
new file mode 100644
index 0000000..ec8ce75
--- /dev/null
+++ b/kubernetes/system/kyverno-policies/kustomization.yaml
@@ -0,0 +1,12 @@
+---
+# Kyverno ClusterPolicies.
+# Applied by the Flux Kustomization "kyverno-policies" which dependsOn "kyverno"
+# (the controller + CRDs). This split is required because Flux dry-runs every
+# resource in a Kustomization before applying any — the ClusterPolicy references
+# the kyverno.io/v2 CRD that only exists once the kyverno HelmRelease installs.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Toggleable emergency relief: strips resources.requests.cpu cluster-wide.
+  # See the file header for the toggle (failurePolicy Ignore/Never) commands.
+  - policy-strip-cpu-requests.yaml
diff --git a/kubernetes/system/kyverno/policy-strip-cpu-requests.yaml b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
similarity index 100%
rename from kubernetes/system/kyverno/policy-strip-cpu-requests.yaml
rename to kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
diff --git a/kubernetes/system/kyverno/kustomization.yaml b/kubernetes/system/kyverno/kustomization.yaml
index 25aa8c5..87c9514 100644
--- a/kubernetes/system/kyverno/kustomization.yaml
+++ b/kubernetes/system/kyverno/kustomization.yaml
@@ -1,4 +1,11 @@
 ---
+# Kyverno controller + CRDs only.
+# The ClusterPolicy lives in a SEPARATE directory (kubernetes/system/kyverno-policies)
+# applied by a SEPARATE Flux Kustomization (kyverno-policies) with dependsOn:
+# kyverno. This split is required because Flux dry-runs every resource in a
+# Kustomization before applying any of them — the ClusterPolicy references the
+# kyverno.io/v2 CRD, which does not exist until this HelmRelease installs it, so
+# bundling them together makes the whole Kustomization fail at dry-run.
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: kyverno
@@ -6,8 +13,5 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release.yaml
-  # ClusterPolicy that strips CPU requests for emergency relief (toggleable).
-  # See policy-strip-cpu-requests.yaml header for the toggle instructions.
-  - policy-strip-cpu-requests.yaml
 configurations:
   - kustomizeconfig.yaml