apiVersion: helm-expt.confighub.com/v1alpha1 kind: LiveHelmConfigHubParityReceipt metadata: name: kyverno-kyverno-3.8.1-default-live-parity-20260605 spec: chart: kyverno/kyverno version: 3.8.1 base: default result: pass observedAt: '2026-06-13T05:54:07Z' package: path: packages/kyverno/kyverno/3.8.1 recipe: path: recipes/kyverno/kyverno/3.8.1 variantRevision: recipes/kyverno/kyverno/3.8.1/revisions/default/r001/variant-revision.yaml targetProfile: name: none result: pass resources: [] gitOpsCanonicalizationProfile: name: k8s-zero-defaults result: pass changes: - 'customresourcedefinition-cleanuppolicies-kyverno-io.yaml: CustomResourceDefinition/cleanuppolicies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-clustercleanuppolicies-kyverno-io.yaml: CustomResourceDefinition/clustercleanuppolicies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-clusterephemeralreports-reports-kyverno-io.yaml: CustomResourceDefinition/clusterephemeralreports.reports.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-clusterpolicies-kyverno-io.yaml: CustomResourceDefinition/clusterpolicies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-clusterpolicyreports-wgpolicyk8s-io.yaml: CustomResourceDefinition/clusterpolicyreports.wgpolicyk8s.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-deletingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/deletingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-deletingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/deletingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-ephemeralreports-reports-kyverno-io.yaml: CustomResourceDefinition/ephemeralreports.reports.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-generatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/generatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-generatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/generatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-globalcontextentries-kyverno-io.yaml: CustomResourceDefinition/globalcontextentries.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-imagevalidatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/imagevalidatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-imagevalidatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/imagevalidatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-mutatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/mutatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-mutatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/mutatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-namespaceddeletingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespaceddeletingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-namespaceddeletingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespaceddeletingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-namespacedgeneratingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedgeneratingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-namespacedgeneratingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedgeneratingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-namespacedimagevalidatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedimagevalidatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-namespacedimagevalidatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedimagevalidatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-namespacedmutatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedmutatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-namespacedmutatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedmutatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-namespacedvalidatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedvalidatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-namespacedvalidatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/namespacedvalidatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-policies-kyverno-io.yaml: CustomResourceDefinition/policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-policyexceptions-kyverno-io.yaml: CustomResourceDefinition/policyexceptions.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-policyexceptions-policies-kyverno-io.yaml: CustomResourceDefinition/policyexceptions.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-policyexceptions-policies-kyverno-io.yaml: CustomResourceDefinition/policyexceptions.policies.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-policyreports-wgpolicyk8s-io.yaml: CustomResourceDefinition/policyreports.wgpolicyk8s.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-updaterequests-kyverno-io.yaml: CustomResourceDefinition/updaterequests.kyverno.io: materialized spec.conversion.strategy=None' - 'customresourcedefinition-validatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/validatingpolicies.policies.kyverno.io: removed metadata.labels empty' - 'customresourcedefinition-validatingpolicies-policies-kyverno-io.yaml: CustomResourceDefinition/validatingpolicies.policies.kyverno.io: materialized spec.conversion.strategy=None' rationale: Normalize Kubernetes API zero/default fields before publishing the OCI GitOps artifact; semantic parity remains checked against Helm. receipt: $HOME/code/helm-expt/runs/live-helm-confighub-compare/kyverno-kyverno-default/gitops-canonicalization-k8s-zero-defaults.yaml run: rig: helm-expt-parity-kyverno-default-final-0613 kubeContext: kind-helm-expt-parity-kyverno-default-final-0613 namespace: default legNamespaces: regularHelm: default-helm configHubKubectlApply: default-apply configHubOciArgo: default-oci clusterLifecycle: cleaned-up cleanup: command: cub lk down --name helm-expt-parity-kyverno-default-final-0613 --force result: pass detail: 'Deleting kind cluster "helm-expt-parity-kyverno-default-final-0613"... Deleting cluster "helm-expt-parity-kyverno-default-final-0613" ... Deleted nodes: ["helm-expt-parity-kyverno-default-final-0613-control-plane"] Deleting Space "helm-expt-parity-kyverno-default-final-0613-cluster" (recursive: cascades to Unit, Target, Worker)... Done.' legs: regularHelm: result: pass command: helm upgrade --install kyverno kyverno --repo https://kyverno.github.io/kyverno --version 3.8.1 --namespace default-helm --create-namespace --values $HOME/code/helm-expt/runs/live-helm-confighub-compare/kyverno-kyverno-default/regular-helm-values.yaml --wait --timeout 10m manifestSHA256: 00df8d584a2b69683a7895eff47d5a2bd6c1947827272bc518b0b79bbba80884 objectCount: 69 liveHelmManifestSHA256: f4351b049b89f21a067fc3bc7f3d86a0f3d0dec86170338be0c8085f8915e774 liveHelmManifestObjectCount: 69 namespace: default-helm runtime: result: pass workloads: 'deployment.apps/kyverno-admission-controller 1/1 1 1 43s deployment.apps/kyverno-background-controller 1/1 1 1 43s deployment.apps/kyverno-cleanup-controller 1/1 1 1 43s deployment.apps/kyverno-reports-controller 1/1 1 1 43s' pods: 'kyverno-admission-controller-7f5984f799-lhs46 1/1 Running 0 43s kyverno-background-controller-57f7cb7c48-qs5n5 1/1 Running 0 43s kyverno-cleanup-controller-68969cf765-96b7v 1/1 Running 0 43s kyverno-reports-controller-dfdd969cd-gqtkr 1/1 Running 0 43s' notReady: [] ignoredJobPods: [] stderr: '' getManifestError: '' configHubKubectlApply: result: pass renderCommand: cub installer setup --pull $HOME/code/helm-expt/packages/kyverno/kyverno/3.8.1 --base default --work-dir /tmp/helm-expt-live-parity-helm-expt-parity-kyverno-default-final-0613-kyverno-kyverno --non-interactive --namespace default-apply applyMode: namespace-first kubectl apply; separated secrets staged when present manifestSHA256: 76f33334e479483cc5bcf4b732587a0d931b0cada4bc0f001c33ba6d2bc6864f objectCount: 70 namespace: default-apply manifestNamespaces: - default - default-apply runtimeNamespaces: &id001 - default runtime: result: pass namespaces: *id001 workloads: '# default deployment.apps/kyverno-admission-controller 1/1 1 1 10s deployment.apps/kyverno-background-controller 1/1 1 1 10s deployment.apps/kyverno-cleanup-controller 1/1 1 1 10s deployment.apps/kyverno-reports-controller 1/1 1 1 10s' pods: '# default kyverno-admission-controller-798db6b999-s5mr2 1/1 Running 0 10s kyverno-background-controller-57f7cb7c48-d627z 1/1 Running 0 10s kyverno-cleanup-controller-5f46cd89f7-fntsk 1/1 Running 0 10s kyverno-reports-controller-dfdd969cd-5h7jv 1/1 Running 0 10s' notReady: [] cleanupBeforeOci: namespaces: - default-apply retainedNamespaces: [] clusterScopedResources: result: pass objectCount: 45 manifest: cluster-scoped-apply-cleanup.yaml detail: 'clusterrole.rbac.authorization.k8s.io "kyverno:admission-controller" deleted clusterrole.rbac.authorization.k8s.io "kyverno:admission-controller:core" deleted clusterrole.rbac.authorization.k8s.io "kyverno:background-controller" deleted clusterrole.rbac.authorization.k8s.io "kyverno:background-controller:core" deleted clusterrole.rbac.authorization.k8s.io "kyverno:cleanup-controller" deleted clusterrole.rbac.authorization.k8s.io "kyverno:cleanup-controller:core" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:admin:policies" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:admin:policyreports" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:admin:reports" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:admin:updaterequests" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:view:policies" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:view:policyreports" deleted clusterrole.rbac.authorization.k8s.io "kyverno:rbac:view' protectedNamespaceResources: result: not-needed namespaces: - default objectCount: 0 preservedPreExistingObjects: - apps/v1|Deployment|default|kyverno-admission-controller - apps/v1|Deployment|default|kyverno-background-controller - apps/v1|Deployment|default|kyverno-cleanup-controller - apps/v1|Deployment|default|kyverno-reports-controller - rbac.authorization.k8s.io/v1|RoleBinding|default|kyverno:admission-controller - rbac.authorization.k8s.io/v1|RoleBinding|default|kyverno:background-controller - rbac.authorization.k8s.io/v1|RoleBinding|default|kyverno:cleanup-controller - rbac.authorization.k8s.io/v1|RoleBinding|default|kyverno:reports-controller - rbac.authorization.k8s.io/v1|Role|default|kyverno:admission-controller - rbac.authorization.k8s.io/v1|Role|default|kyverno:background-controller - rbac.authorization.k8s.io/v1|Role|default|kyverno:cleanup-controller - rbac.authorization.k8s.io/v1|Role|default|kyverno:reports-controller - v1|ConfigMap|default|kyverno - v1|ConfigMap|default|kyverno-metrics - v1|ServiceAccount|default|kyverno-admission-controller - v1|ServiceAccount|default|kyverno-background-controller - v1|ServiceAccount|default|kyverno-cleanup-controller - v1|ServiceAccount|default|kyverno-reports-controller - v1|Service|default|kyverno-background-controller-metrics - v1|Service|default|kyverno-cleanup-controller - v1|Service|default|kyverno-cleanup-controller-metrics - v1|Service|default|kyverno-reports-controller-metrics - v1|Service|default|kyverno-svc - v1|Service|default|kyverno-svc-metrics reason: isolate the OCI/Argo leg from direct-apply workloads in single-cluster parity rigs configHubOciArgo: result: pass workloadSpace: helm-expt-parity-kyverno-default-final-0613-kyverno-kyverno controller: Argo CD OCI app: kyverno-kyverno-parity manifestSHA256: c60de57940e9b57cf21fde0e7ed78ec27d32aa49f3bf9f02e35be6182f685daf objectCount: 70 namespace: default-oci manifestNamespaces: - default - default-oci runtimeNamespaces: &id002 - default ociRevision: sha256:7311cb8bd2c0315b3e5cedfbd3a088a836dea0e3271c8d4f01dac54a92b00e9a sync: Synced health: Healthy separatedSecrets: [] argoStatus: result: recorded sync: comparedTo: destination: namespace: default-oci server: https://kubernetes.default.svc source: path: ./helm-expt-parity-kyverno-default-final-0613-kyverno-kyverno repoURL: oci://oci.hub.confighub.com:443/target/helm-expt-parity-kyverno-default-final-0613-cluster/oci targetRevision: latest revision: sha256:7311cb8bd2c0315b3e5cedfbd3a088a836dea0e3271c8d4f01dac54a92b00e9a status: Synced health: lastTransitionTime: '2026-06-13T06:05:37Z' status: Healthy operationState: phase: Succeeded message: successfully synced (all tasks run) conditions: [] resources: - group: '' kind: ConfigMap namespace: default name: kyverno status: Synced health: '' hook: false - group: '' kind: ConfigMap namespace: default name: kyverno-metrics status: Synced health: '' hook: false - group: '' kind: Namespace namespace: '' name: default-oci status: Synced health: '' hook: false - group: '' kind: Service namespace: default name: kyverno-background-controller-metrics status: Synced health: '' hook: false - group: '' kind: Service namespace: default name: kyverno-cleanup-controller status: Synced health: '' hook: false - group: '' kind: Service namespace: default name: kyverno-cleanup-controller-metrics status: Synced health: '' hook: false - group: '' kind: Service namespace: default name: kyverno-reports-controller-metrics status: Synced health: '' hook: false - group: '' kind: Service namespace: default name: kyverno-svc status: Synced health: '' hook: false - group: '' kind: Service namespace: default name: kyverno-svc-metrics status: Synced health: '' hook: false - group: '' kind: ServiceAccount namespace: default name: kyverno-admission-controller status: Synced health: '' hook: false - group: '' kind: ServiceAccount namespace: default name: kyverno-background-controller status: Synced health: '' hook: false - group: '' kind: ServiceAccount namespace: default name: kyverno-cleanup-controller status: Synced health: '' hook: false - group: '' kind: ServiceAccount namespace: default name: kyverno-reports-controller status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: cleanuppolicies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: clustercleanuppolicies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: clusterephemeralreports.reports.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: clusterpolicies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: clusterpolicyreports.wgpolicyk8s.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: deletingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: ephemeralreports.reports.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: generatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: globalcontextentries.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: imagevalidatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: mutatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: namespaceddeletingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: namespacedgeneratingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: namespacedimagevalidatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: namespacedmutatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: namespacedvalidatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: policyexceptions.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: policyexceptions.policies.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: policyreports.wgpolicyk8s.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: updaterequests.kyverno.io status: Synced health: '' hook: false - group: apiextensions.k8s.io kind: CustomResourceDefinition namespace: '' name: validatingpolicies.policies.kyverno.io status: Synced health: '' hook: false - group: apps kind: Deployment namespace: default name: kyverno-admission-controller status: Synced health: '' hook: false - group: apps kind: Deployment namespace: default name: kyverno-background-controller status: Synced health: '' hook: false - group: apps kind: Deployment namespace: default name: kyverno-cleanup-controller status: Synced health: '' hook: false - group: apps kind: Deployment namespace: default name: kyverno-reports-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:admission-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:admission-controller:core status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:background-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:background-controller:core status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:cleanup-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:cleanup-controller:core status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:admin:policies status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:admin:policyreports status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:admin:reports status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:admin:updaterequests status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:view:policies status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:view:policyreports status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:view:reports status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:rbac:view:updaterequests status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:reports-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRole namespace: '' name: kyverno:reports-controller:core status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:admission-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:admission-controller:view status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:background-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:background-controller:view status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:cleanup-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:reports-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: ClusterRoleBinding namespace: '' name: kyverno:reports-controller:view status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: Role namespace: default name: kyverno:admission-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: Role namespace: default name: kyverno:background-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: Role namespace: default name: kyverno:cleanup-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: Role namespace: default name: kyverno:reports-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: RoleBinding namespace: default name: kyverno:admission-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: RoleBinding namespace: default name: kyverno:background-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: RoleBinding namespace: default name: kyverno:cleanup-controller status: Synced health: '' hook: false - group: rbac.authorization.k8s.io kind: RoleBinding namespace: default name: kyverno:reports-controller status: Synced health: '' hook: false rootArgoStatus: result: recorded sync: comparedTo: destination: namespace: argocd server: https://kubernetes.default.svc source: path: ./helm-expt-parity-kyverno-default-final-0613-cluster repoURL: oci://oci.hub.confighub.com:443/target/helm-expt-parity-kyverno-default-final-0613-cluster/oci targetRevision: latest revision: sha256:7311cb8bd2c0315b3e5cedfbd3a088a836dea0e3271c8d4f01dac54a92b00e9a status: Synced health: lastTransitionTime: '2026-06-13T05:55:41Z' status: Healthy operationState: phase: Succeeded message: successfully synced (all tasks run) conditions: [] resources: - group: argoproj.io kind: Application namespace: argocd name: helm-expt-parity-kyverno-default-final-0613-cluster status: Synced health: '' hook: false - group: argoproj.io kind: Application namespace: argocd name: kyverno-kyverno-parity status: Synced health: '' hook: false runtime: result: pass namespaces: *id002 workloads: '# default deployment.apps/kyverno-admission-controller 1/1 1 1 8m42s deployment.apps/kyverno-background-controller 1/1 1 1 8m42s deployment.apps/kyverno-cleanup-controller 1/1 1 1 8m42s deployment.apps/kyverno-reports-controller 1/1 1 1 8m42s' pods: '# default kyverno-admission-controller-798db6b999-s5mr2 1/1 Running 0 8m42s kyverno-background-controller-57f7cb7c48-d627z 1/1 Running 0 8m42s kyverno-cleanup-controller-5f46cd89f7-fntsk 1/1 Running 0 8m42s kyverno-reports-controller-dfdd969cd-5h7jv 1/1 Running 0 8m42s' notReady: [] semanticComparison: allowedExtraConfigHubObjects: - v1|Namespace||default semanticNormalizations: &id003 - prune-null-fields helmVsConfigHubKubectlApply: result: pass helmObjectCount: 69 configHubObjectCount: 70 missingFromConfigHub: [] extraInConfigHub: - v1|Namespace||default semanticDiffs: [] semanticNormalizations: *id003 comparisonSHA256: c90ccd49553545d990093d205a77069ff9881faac63f0338fd802eefca910e4f helmVsConfigHubOciArgo: result: pass helmObjectCount: 69 configHubObjectCount: 70 missingFromConfigHub: [] extraInConfigHub: - v1|Namespace||default semanticDiffs: [] semanticNormalizations: - prune-null-fields - k8s-zero-defaults comparisonSHA256: 2ab8b111e44939c9f6a0e10e1d63118cca7e95587bf928397d043cd5edc9661d checks: - name: live-lane-lock result: pass detail: acquired $HOME/.confighub/locks/helm-expt-live-parity.lock - name: cub-lk-up result: pass detail: "Creating kind cluster \"helm-expt-parity-kyverno-default-final-0613\"\ \ (kubeconfig: $HOME/.confighub/lk/helm-expt-parity-kyverno-default-final-0613.kubeconfig)...\n\ Creating cluster \"helm-expt-parity-kyverno-default-final-0613\" ...\n \u2022\ \ Ensuring node image (kindest/node:v1.35.0) \U0001F5BC ...\n \u2713 Ensuring\ \ node image (kindest/node:v1.35.0) \U0001F5BC\n \u2022 Preparing nodes \U0001F4E6\ \ ...\n \u2713 Preparing nodes \U0001F4E6 \n \u2022 Writing configuration\ \ \U0001F4DC ...\n \u2713 Writing configuration \U0001F4DC\n \u2022 Starting\ \ control-plane \U0001F579\uFE0F ...\n \u2713 Starting control-plane \U0001F579\ \uFE0F\n \u2022 Installing CNI \U0001F50C ...\n \u2713 Installing CNI \U0001F50C\ \n \u2022 Installing StorageClass \U0001F4BE ...\n \u2713 Installing StorageClass\ \ \U0001F4BE\nSet kubectl context to \"kind-helm-expt-parity-kyverno-default-final-0613\"\ \nYou can now use your cluster with:\n\nkubectl cluster-info --context kind-helm-expt-parity-kyverno-default-final-0613\ \ --kubeconfig $HOME/.confighub/lk/helm-expt-parity-kyverno-default-final-0613.kubeconfig\n\ \nHave a nice day! \U0001F44B\nInstalling Argo CD...\nCreating namespace \"\ argocd\"...\napiVersion: v1\nkind: Names" - name: target-facts-regular-helm result: pass detail: secrets=0 crds=0 - name: regular-helm-live result: pass detail: "Release \"kyverno\" does not exist. Installing it now.\nNAME: kyverno\n\ LAST DEPLOYED: Sat Jun 13 06:55:37 2026\nNAMESPACE: default-helm\nSTATUS: deployed\n\ REVISION: 1\nDESCRIPTION: Install complete\nNOTES:\nChart version: 3.8.1\nKyverno\ \ version: v1.18.1\n\nThank you for installing kyverno! Your release is named\ \ kyverno.\n\nThe following components have been installed in your cluster:\n\ - CRDs\n- Admission controller\n- Reports controller\n- Cleanup controller\n\ - Background controller\n\n\n\u26A0\uFE0F WARNING: Setting the admission controller\ \ replica count below 2 means Kyverno is not running in high availability mode.\n\ \n\n\u26A0\uFE0F WARNING: PolicyExceptions are disabled by default. To enable\ \ them, set '--enablePolicyException' to true.\n\n\U0001F4A1 Note: There is\ \ a trade-off when deciding which approach to take regarding Namespace exclusions.\ \ Please see the documentation at https://kyverno.io/docs/installation/#security-vs-operability\ \ to understand the risks." - name: target-facts-confighub-apply result: pass detail: secrets=0 crds=0 - name: confighub-kubectl-apply-live result: pass detail: '# default deployment.apps/kyverno-admission-controller 1/1 1 1 10s deployment.apps/kyverno-background-controller 1/1 1 1 10s deployment.apps/kyverno-cleanup-controller 1/1 1 1 10s deployment.apps/kyverno-reports-controller 1/1 1 1 10s' - name: confighub-kubectl-apply-cluster-cleanup result: pass detail: objects=45 - name: target-facts-confighub-oci result: pass detail: secrets=0 crds=0 - name: confighub-oci-argo-live result: pass detail: sync=Synced health=Healthy after 220s - name: semantic-object-parity result: pass detail: apply=pass argo=pass applyDiffs=0 argoDiffs=0 targetFacts: regularHelm: result: pass stagedSecrets: [] stagedCRDs: [] configHubKubectlApply: result: pass stagedSecrets: [] stagedCRDs: [] configHubOciArgo: result: pass stagedSecrets: [] stagedCRDs: [] operatingPolicy: regularHelm: result: pass operation: none configHubKubectlApply: result: pass operation: none namespace: default-apply configHubOciArgo: result: pass operation: none namespace: default-oci