Description
Kyverno Version:
v1.13.2
Kubernetes Version:
v1.31.7
Kubernetes Platform:
AWS EKS
Description:
When using the verifyImages policy type in Kyverno in combination with ArgoCD (version v2.14.7), both application deletion and synchronization fail. This issue significantly impacts the ability to manage deployments through ArgoCD when image verification policies are enabled.
Steps to reproduce:
- Set up an ArgoCD application managed with Kyverno policies.
- Apply a verifyImages policy with the following configuration:
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: verify-image
spec:
validationFailureAction: Enforce
rules:
- name: verify-my-app
match:
any:
- resources:
kinds:
- Deployment
namespaces:
- "my-app-namespace"
preconditions:
- key: "{{ request.object.spec.replicas }}"
operator: GreaterThan
value: 0
verifyImages:
- imageReferences:
- "my-image-registry.com/my-app-image*"
mutateDigest: true
imageRegistryCredentials:
secrets:
- my-app-pull-secret
- Attempt to delete or synchronize the application using ArgoCD.
- Observe the error message as described above.
Expected behavior:
ArgoCD should be able to delete or synchronize applications that have a Kyverno verifyImages policy applied, as long as the policy conditions are met (e.g., having a digest for the specified image).
Actual Behavior:
When attempting to delete or synchronize a deployment managed by ArgoCD, the following error occurs:
one or more objects failed to apply, reason: error when patching "/dev/shm/5898210957": admission webhook "validate.kyverno.svc-ignore" denied the request: resource Deployment/my-app-namespace/my-app was blocked due to the following policies verify-image:my-app-image: missing digest for my-image-registry.com/my-app-image:1.0.1010
Additional Information:
The issue may be related to how ArgoCD and Kyverno interact when managing application states, particularly when using image verification policies. It appears that Kyverno enforces image digest checks even when the intended action is a synchronization or deletion, leading to blocked operations.
Kyverno logs:
2025-05-13T22:33:27Z TRC github.com/kyverno/kyverno/pkg/engine/handlers/validation/validate_image.go:110 > missing digest image=my-image-registry.com/my-app-image:1.0.1010 logger=engine.validate new.kind=Deployment new.name=my-app new.namespace=my-app-namespace policy.apply=All policy.name=verify-image policy.namespace= rule.name= verify-my-app v=2