From bb443f3311ee2c3c2871bd3ab978e2edfee2c2c4 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Wed, 14 Oct 2026 17:42:49 +0200 Subject: [PATCH] kyverno-policies(kube): exclude longhorn instance-manager pods from cpu stripping The longhorn instance-manager and engine-image pods carry longhorn.io/component labels, not app, so the exclusions never matched. Kyverno stripped their cpu requests at admission, longhorn-manager saw a spec mismatch and deleted the pod in a loop, and after any node reboot all longhorn volumes stayed detached with every workload stuck in ContainerCreating. Match the real labels instead. --- .../system/kyverno-policies/policy-strip-cpu-requests.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml index 17d163b..60c316b 100644 --- a/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml +++ b/kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml @@ -80,13 +80,13 @@ spec: - longhorn-system selector: matchLabels: - app: instance-manager + longhorn.io/component: instance-manager - resources: namespaces: - longhorn-system selector: matchLabels: - app: engine-image + longhorn.io/component: engine-image mutate: # `request.object` is available in BOTH admission and background modes: # the backgroundController synthesizes an admission-like request for