kyverno(kube): add kyverno

add a policy to remove cpu requests, to relieve cluster

kubernetes/system/flux/kustomization.yaml

@@ -13,3 +13,4 @@ resources:
   - longhorn-jobs.yaml
   - openclaw-operator.yaml
   - openclaw.yaml
+  - kyverno.yaml

kubernetes/system/flux/kyverno.yaml

@@ -0,0 +1,24 @@
+---
+# Flux Kustomization for Kyverno
+# Separate from main homeprod because Kyverno CRDs (installed by the HelmRelease)
+# must be present before the ClusterPolicy can be applied.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno
+  namespace: flux-system
+spec:
+  interval: 5m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/kyverno
+  # Wait for the admission controller Deployment to be Ready before Flux
+  # considers this Kustomization healthy — this ensures the ClusterPolicy
+  # is applied after the CRDs and controller are live.
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: kyverno-admission-controller
+      namespace: kyverno