From 3d258f147d8da673ce8344416c7a44151f90e4ed Mon Sep 17 00:00:00 2001
From: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Date: Wed, 9 Sep 2026 23:07:13 +0200
Subject: [PATCH] kyverno(kube): foreach patchStrategicMerge must be inline
 mapping, not block scalar

---
 .../system/kyverno-policies/policy-strip-cpu-requests.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
index aecf625..94ed35c 100644
--- a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
+++ b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml
@@ -88,9 +88,12 @@ spec:
         # `request.object` is available in BOTH admission and background modes:
         # the backgroundController synthesizes an admission-like request for
         # existing resources, so the same foreach works for both.
+        # NOTE: inside `foreach`, patchStrategicMerge must be an INLINE YAML
+        # mapping — a `|` block scalar is parsed as a string and fails with
+        # "wrong node kind: expected MappingNode but got ScalarNode".
         foreach:
           - list: "request.object.spec.containers"
-            patchStrategicMerge: |
+            patchStrategicMerge:
               spec:
                 containers:
                   - name: "{{ element.name }}"
@@ -98,7 +101,7 @@ spec:
                       requests:
                         cpu: null
           - list: "request.object.spec.initContainers || `[]`"
-            patchStrategicMerge: |
+            patchStrategicMerge:
               spec:
                 initContainers:
                   - name: "{{ element.name }}"