Kyverno & Kyverno Policies

Plan a short maintenance window: these steps briefly remove Kyverno admission control from
the cluster. Run kubectl against the target cluster.

Use this procedure only after confirming that no other installation, including KSPM, uses the Kyverno CRDs or webhooks. CRDs are shared across the cluster. Export all custom policy types used by the old installation before deleting their CRDs; the backup command below covers only ClusterPolicy and Policy. Delete only resources that belong to the old application, using their verified names.

0. (Recommended) Back up custom policies

Step 3 deletes Kyverno’s CRDs, which removes all ClusterPolicy/Policy objects — including
any you authored. (The bundled Pod Security Standards policies are re-created when Kyverno Policies is enabled with the baseline or restricted profile; save your own custom policies separately.) Historical PolicyReports are also
removed and will be regenerated after reinstall.

kubectl get clusterpolicies.kyverno.io,policies.kyverno.io -A -o yaml > my-kyverno-policies-backup.yaml

1. Remove the old version via the Marketplace

Delete the old application through the Marketplace, not with raw helm uninstall:

• Console: Managed Service for Kubernetes → your cluster → Marketplace / installed
  applications → delete the Kyverno application; or
• Terraform: remove the yandex_kubernetes_marketplace_helm_release resource and
  terraform apply (destroy).

This runs the old chart’s pre-delete hook (which removes Kyverno’s admission webhooks) and
clears the Marketplace’s record of the install. A raw helm uninstall skips the Marketplace and
orphans the app record, later causing AlreadyExists when you install the new version.

2. Delete any leftover Kyverno admission webhooks — critical

Kyverno self-registers its webhooks at runtime. If any survive step 1 (e.g. the old pod was
unhealthy and the pre-delete hook didn’t run), they point at a Service that no longer exists and
may block matching API requests, depending on their failure policy. Inspect each webhook’s service reference and delete only webhooks that belong to the removed application. Replace the placeholders below with verified names and repeat for each leftover webhook:

kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kyverno
kubectl delete validatingwebhookconfiguration <old-kyverno-validating-webhook>
kubectl delete mutatingwebhookconfiguration <old-kyverno-mutating-webhook>

3. Delete the old Kyverno CRDs — required

Helm installs a chart’s CRDs (the crds/ directory) only when the CRDs don’t already exist —
it never updates or replaces existing ones. If the old (Kyverno 1.9) CRDs remain, the new
install keeps the stale definitions and the new v1.19.2 controllers crash-loop on their CRD sanity
checks (missing ephemeralreports.reports.kyverno.io, the policies.kyverno.io group, etc.).
Delete only CRDs belonging exclusively to the old application so the new definitions can be installed:

kubectl get crd -o name
kubectl delete crd <old-kyverno-crd>

Repeat the deletion for each verified CRD of the old installation. Do not classify updaterequests.kyverno.io as a removed type: it is also supplied by the current version.

4. Delete the old namespace

Delete only the dedicated namespace of the old application, after confirming it contains no other applications. Never delete default or a shared namespace; remove only the old application’s resources there:

kubectl delete namespace <old-namespace>

5. Verify the cluster is clean

kubectl get crd | grep -E 'kyverno\.io|wgpolicyk8s\.io'                     # none
kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kyverno   # none
kubectl get ns <old-namespace>                                             # NotFound

6. Install the new version

Install the new Kyverno version.

Then verify and re-apply any custom policies from step 0:

kubectl -n <namespace> get pods            # 4 controllers Running: admission/background/cleanup/reports
kubectl get clusterpolicies.kyverno.io     # PSS policies if enabled with baseline/restricted

When reviewing backed-up custom policies, replace the deprecated
spec.validationFailureAction with per-rule spec.rules[].validate.failureAction
(Audit/Enforce).