Kyverno & Kyverno Policies

Plan a short maintenance window: these steps briefly remove Kyverno admission control from
the cluster. Run kubectl against the target cluster.

0. (Recommended) Back up custom policies

Step 3 deletes Kyverno’s CRDs, which removes all ClusterPolicy/Policy objects — including
any you authored. (The bundled Pod Security Standards policies are re-created automatically by the
new product; only your own custom policies need saving.) Historical PolicyReports are also
removed and will be regenerated after reinstall.

kubectl get clusterpolicies.kyverno.io,policies.kyverno.io -A -o yaml > my-kyverno-policies-backup.yaml

1. Remove the old version via the Marketplace

Delete the old application through the Marketplace, not with raw helm uninstall:

• Console: Managed Service for Kubernetes → your cluster → Marketplace / installed
  applications → delete the Kyverno application; or
• Terraform: remove the yandex_kubernetes_marketplace_helm_release resource and
  terraform apply (destroy).

This runs the old chart’s pre-delete hook (which removes Kyverno’s admission webhooks) and
clears the Marketplace’s record of the install. A raw helm uninstall skips the Marketplace and
orphans the app record, later causing AlreadyExists when you install the new version.

2. Delete any leftover Kyverno admission webhooks — critical

Kyverno self-registers its webhooks at runtime. If any survive step 1 (e.g. the old pod was
unhealthy and the pre-delete hook didn’t run), they point at a Service that no longer exists and
block all pod creation cluster-wide. Verify none remain, and delete any that do:

kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kyverno
kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations -o name \
  | grep kyverno | xargs -r kubectl delete

3. Delete the old Kyverno CRDs — required

Helm installs a chart’s CRDs (the crds/ directory) only when the CRDs don’t already exist —
it never updates or replaces existing ones. If the old (Kyverno 1.9) CRDs remain, the new
install keeps the stale definitions and the new v1.18 controllers crash-loop on their CRD sanity
checks (missing ephemeralreports.reports.kyverno.io, the policies.kyverno.io group, etc.).
Delete every Kyverno CRD so the new, correct set is installed:

kubectl get crd -o name | grep -E 'kyverno\.io|wgpolicyk8s\.io' | xargs -r kubectl delete

This also removes old CRD types dropped in v1.18 (e.g. generaterequests, updaterequests).

4. Delete the old namespace

Remove the namespace the old version used (or confirm it’s empty before reusing it):

kubectl delete namespace <old-namespace>

5. Verify the cluster is clean

kubectl get crd | grep -E 'kyverno\.io|wgpolicyk8s\.io'                     # none
kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kyverno   # none
kubectl get ns <old-namespace>                                             # NotFound

6. Install the new version

Install the new Kyverno version.

Then verify and re-apply any custom policies from step 0:

kubectl -n <namespace> get pods            # 4 controllers Running: admission/background/cleanup/reports
kubectl get clusterpolicies.kyverno.io     # the PSS policies, READY=true

When reviewing backed-up custom policies, note Kyverno v1.18 moved
spec.validationFailureAction to per-rule spec.rules[].validate.failureAction
(Audit/Enforce).