Repository navigation
Clean up successful Kyverno migration jobs after upgrades #5491
Description
🤖 Generated by the Agentic Engineer
Problem
Kyverno's chart removes a successful migration hook's temporary service account but retains the completed job. The leftover job keeps a reference to an account that no longer exists and can produce misleading posture results after an upgrade.
Evidence
The published migration-hook template deletes the temporary account on success while leaving the job's deletion policy commented out. A fresh read-only observation reproduces that completed-hook lifecycle. Detailed runtime evidence remains private.
Acceptance
- Preserve the migration's execution identity, required permissions and resource scope; do not recreate obsolete permissions to satisfy a scan.
- Clean up successful migration jobs through their reviewed Helm lifecycle. Keep failure diagnostics available, and leave unrelated hooks and jobs unchanged.
- Prove the actual chart and deployed Helm version apply the intended hook change, including a failing-before/passing-after regression and negative controls for unrelated jobs.
- Deploy through the protected path, observe a successful migration and normal cleanup, and verify a current attributable scan. An orphaned report or unbound scan remains unresolved; do not delete reports, suppress the control or add an exception.
Part of #2043
Delivered on: 2026-10-31
Measure on: 2026-11-01
Resume condition: Re-enter verification when stored posture results can be attributed to the natural scan that completed on 2026-11-01. The scheduler succeeded at 09:12 UTC and the scanner recorded completion and saved results at 09:21 UTC; both stored scan surfaces still identify the 2026-10-31 report. The old migration Job and its report are currently absent, but absence without fresh attributable results does not satisfy acceptance. Do not dispatch an extra scan, delete reports, suppress findings or infer acceptance from scheduler or scanner completion alone. If current report identity or attribution remains unavailable, keep this issue open with that exact condition.
The hook lifecycle change was delivered through #5637 at merged source 72a83004aab783cde9b88c6038aadd022d9d9d3c. The recorded successful migration and cleanup remain partial acceptance; the original criteria, failure-diagnostic requirements and flow clocks are unchanged.
Metadata
Metadata
Assignees
Type
Fields
Priority
Effort
Projects
- Status
Activity
chore: agent-claim #5491 nonce=61b173a1762522c70074da078a7038bb
chore: agent-claim #5491 nonce=9065375c7aae04b83d52ea832b7acb94
devantler commentedon Oct 28, 2026
The combined-stream validation prerequisite is now on protected main through #5505. The lifecycle cleanup remains a separate rollout and is natively blocked by #5542, which prepares patched migration tooling from the released implementation.
Resume deployment after the runtime is published and independently verified and its verification policy is active. Then apply the narrowly targeted hook lifecycle change, observe the successful migration and cleanup, and obtain a fresh attributable posture scan before closing this issue.
chore: agent-claim #5491 nonce=2d4999a4c3e93dcefbcbe2752d88b1cf
devantler commentedon Oct 31, 2026
First real run, through #5637's merge-group deploy (run 41244989833). Read live at 22:12Z on 2026-10-31.
platform-kyverno-migrate, and the Job completed.Not yet met. The posture report for this Job, created 2026-06-25, still exists: it predates this change, and no scan has run since the deploy. The next scheduled scan is 2026-11-01 at 09:12Z. After it, read whether that report is gone or still orphaned. An orphaned report stays unresolved here; it is not to be deleted or suppressed by hand. Failure diagnostics and a failed hook have not been exercised on the real cluster.
This issue stays open until that read is recorded.
chore: agent-claim #5491 nonce=25c43e1d2c2506d392396b63531ff57e
chore: agent-claim #5491 nonce=661a68c2446b855c208733a7c37b4036
chore: agent-claim #5491 nonce=916ffb35553c4fe5a871cf9edb48653c
devantler commentedon Nov 1, 2026
Returned this delivered check to Ready with an explicit resume condition. A fresh read confirms the natural posture scan is enabled for 09:12 UTC today; its latest scheduled execution was before #5637's protected delivery. The next run after that scan completes should verify fresh attributable posture data and whether the old migration-job report has cleared.
The issue remains open. This move does not establish scan success or waive the existing acceptance criteria; no scan was dispatched and no report was deleted. Original flow clocks are preserved.
chore: agent-claim #5491 nonce=411819b721ffab09eb696ab95c1ed839
chore: agent-claim #5491 nonce=d6b6185c23bac266f883117b95962dd1
devantler commentedon Nov 1, 2026
Blocker: Fresh stored posture results attributable to the completed 2026-11-01 scan | outcome | last-verified 2026-11-01: The natural scan completed, and the old migration-job report is absent from both stored scan surfaces. Their report identity still names 2026-10-31, so fresh attributable acceptance remains unverified. Re-enter when current report identity and results can be read; do not dispatch another scan, delete reports or suppress findings.
chore: agent-claim #5491 nonce=720f7ce07f338defb8dd12d1e7f090da
devantler commentedon Nov 1, 2026
Measured after the natural posture scan of 2026-11-01. No scan was dispatched and no report was deleted by this run.
report-created-at09:21:39Z today, and the report for an unchanged deployment moved to a new resource version. So this is fresh data from a completed scan.UpgradeSucceeded.All four acceptance criteria now have evidence, so I am closing this as delivered.
Limits: