Kyverno 1.16.2

Kyverno 1.16.2

FractalOps pins Kyverno chart 3.6.2, application version 1.16.2. Investigation date: 2026-07-31. Assembly owns controller deployment and RBAC; resource owners decide which exact objects receive cleanup metadata.

Supported Path

• Put cleanup.kyverno.io/ttl only on explicitly test-owned resources.
• Put cleanup.kyverno.io/propagation-policy: Foreground on an owner resource when Kubernetes garbage collection must remove dependents first.
• Grant the cleanup controller only get, list, watch, and delete for each selected resource kind.
• Keep deterministic test teardown. TTL cleanup is only the crash/timeout safety net.

Traps

• A name, namespace, resource age, or failed phase is not ownership proof.
• Do not propagate the TTL label to dependents; delete the verified owner and let foreground garbage collection follow owner references.
• Relative TTL starts when Kyverno observes the label. Keep the independent FractalOps created-at and expires-at metadata for audit and diagnosis.
• Broad periodic kubectl delete jobs bypass provenance and are forbidden.

Verification

kubectl -n kyverno auth can-i delete clusters.postgresql.cnpg.io \
  --as=system:serviceaccount:kyverno:kyverno-cleanup-controller
kubectl -n fractalops-migration-ci get clusters.postgresql.cnpg.io \
  -l fractalops.yamon.io/test-owned=true

Authoritative references: cleanup label and propagation policy and cleanup controller configuration.