This PR addresses an incompatible change introduced in newer versions of the Kyverno chart, mainly that kyverno.cleanupController.rbac.clusterRole.extraResources[0].verbs now needs to be set.

It also cleans up two case where we set mutateExistingOnPolicyUpdate: false despite that being the default, and replaced instances of {{ request.namespace }} with {{ request.object.metadata.namespace }} because these seem to be problematic in Kyverno 1.11.

However, the Kyverno version remains as 1.10.0, and we have left the chart version as 3.0.1

WARNING: We still can NOT update to any version of Kyverno from 1.10.1 to 1.11.4, as all have problems that make them incompatible with deployKF:

• [Bug] mutate rules with targets fail to apply for trigger resources with names > 63 characters kyverno/kyverno#9134
• [Bug] policies with both clone AND mutate rules (with targets set) do not clone kyverno/kyverno#9571
• [Bug] all versions since 1.10.1 (including 1.11.4) fail to clone (and deadlock) if source is created after policy kyverno/kyverno#9560
  • NOTE: While this was not "broken" it was a change in behavior from what we relied on. So we may need to use an alternative secret-cloning tool to move secrets across namespaces.
• [Bug] significant decrease in generate rule performance (+ too many UpdateRequests) kyverno/kyverno#9633