auto-reload Kyverno on CRD changes ?
We were discussing with @alain.thioliere on !1256 (merged) and saying that it would really be great to implement a workaround to an issue we know Kyverno has: when a CRD is created (or a new apiVersion added) Kyverno does not notice it because it caches this information too agressively (upstream issue https://github.com/kyverno/kyverno/issues/10729 )...
One possibility I suggested:
- introduce something that would periodically list all CRDs (name and list of apiVersions) and calculate a hash from that, and put it into a configmap
- this could be a quick'n'dirty kube-cronjob... it would be throw-away code, useless once the issue is solved upstream
- inject this hash into Kyverno Helm values via a valuesFrom in a place where it will result, when changed, into a rolling update of Kyverno pods
/cc @feleouet