Help with understanding background policies
Running:
kyverno: 1.12.6 k8s: 1.30.6 (Azure AKS)
I have below policy, which supposedly should update deployments with the costsavedownscale: "true" label if they are in the correct namespace and cluster name is right. And it is working, but only by admission, not background controller. So unless there is a change made to the deployment, label isn't assigned.
I can see that background controller adds UR, but nothing else happens, no label being added.
So, is this something I do not understand or doing correctly?
kyverno-background-controller-7996c8578-s5zst controller 2025-02-06T15:05:20Z INFO PolicyController.handleMutate.mutate-deployments-adding-secondary-clusters-label policy/mutate.go:15 update URs on policy event
kyverno-background-controller-7996c8578-s5zst controller 2025-02-06T15:05:22Z INFO PolicyController.handleGenerate.mutate-deployments-adding-secondary-clusters-label policy/generate.go:21 update URs on policy event
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: mutate-deployments-adding-secondary-clusters-label
annotations:
policies.kyverno.io/title: Mutate deployments
policies.kyverno.io/category: Deployment
policies.kyverno.io/subject: Deployment, Pod
policies.kyverno.io/minversion: 1.6.0
policies.kyverno.io/description: "This policy adds downscale labels to secondary clusters deployments"
spec:
mutateExistingOnPolicyUpdate: true
rules:
- name: mutate-deployments
context:
- name: namespacefilters
configMap:
name: namespace-filters
namespace: kyverno
match:
any:
- resources:
kinds:
- Deployment
namespaces:
- "ns-org*"
exclude:
any:
- resources:
kinds:
- Deployment
namespaceSelector:
matchExpressions:
- key: active
operator: In
values: ["true"]
preconditions:
all:
- key: "{{ namespacefilters.data.clustername || '' }}"
operator: AnyIn
value: "{{ \"namespacefilters\".data.\"secondaryclusters\" | parse_json(@) }}"
mutate:
targets:
- apiVersion: apps/v1
kind: Deployment
name: "{{ request.object.metadata.name }}"
patchStrategicMerge:
metadata:
labels:
costsavedownscale: "true"