Upgrade CHART_VERSION to 3.8.2 - App version 1.18.2

[aswnrana]

Upgrade CHART_VERSION to 3.8.2

Kyverno chart 3.7.0 → 3.8.2, which is app version v1.17.0 → v1.18.2.

Changed

• .chart-attributes — CHART_VERSION=3.8.2
• addon.yaml, controller.yaml — webhooksCleanup.image.repository: upbound/kyverno-kubectl → upbound/kyverno-readiness-checker

Added

• hack/sync-images.sh — mapping for ghcr.io/kyverno/readiness-checker → xpkg.upbound.io/upbound/kyverno-readiness-checker

Removed

• addon.yaml, controller.yaml — the policyReportsCleanup override

Why the image changes

Chart 3.8.x switches the webhooks cleanup hook off kubectl and onto Kyverno's own binary (charts/kyverno/values.yaml):

	3.7.0	3.8.2
webhooksCleanup.image	registry.k8s.io/kubectl:v1.34.3	ghcr.io/kyverno/readiness-checker:v1.18.2

It feeds the kyverno-rm-webhooks and kyverno-scale-to-zero pre-delete hooks. Unmapped source images are skipped by sync-images.sh with a warning and the job still exits 0, so without the new mapping the image never reaches xpkg and uninstall fails on ImagePullBackOff.

upbound/kyverno-readiness-checker has been provisioned on xpkg for this — mirroring it into kyverno-kubectl would put two unrelated binaries under one name.

policyReportsCleanup was dropped because no chart since 3.4.2 references that key anywhere — values, templates, or subcharts. Rendering 3.8.2 with and without it produces byte-identical output.

How has this code been tested

Locally against the real chart and registry, before pushing:

================================================================
BASELINE — chart 3.7.0 (Kyverno v1.17.0)
================================================================

$ kubectl get addon upbound-addon-kyverno
NAME                    INSTALLED   HEALTHY   PACKAGE                                       AGE
upbound-addon-kyverno   True        True      xpkg.upbound.io/upbound/addon-kyverno:3.7.0   26m

$ kubectl get pods -n kyverno-system
kyverno-admission-controller-656659959b-b4ssl    1/1   Running   0   26m
kyverno-background-controller-798f4744cc-zvhwj   1/1   Running   0   26m
kyverno-cleanup-controller-cccd59d76-g9lvd       1/1   Running   0   26m
kyverno-reports-controller-74c87bcf46-96trq      1/1   Running   0   26m

$ kubectl get pods -n kyverno-system -o jsonpath='{.items[*].spec.containers[0].image}' | tr ' ' '\n'
xpkg.upbound.io/upbound/kyverno:v1.17.0
xpkg.upbound.io/upbound/kyverno-background-controller:v1.17.0
xpkg.upbound.io/upbound/kyverno-cleanup-controller:v1.17.0
xpkg.upbound.io/upbound/kyverno-reports-controller:v1.17.0

$ kubectl get clusterpolicy
NAME                             ADMISSION   BACKGROUND   READY   AGE     MESSAGE
smoke-test-require-owner-label   true        true        True    2m15s   Ready

$ kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kyverno | wc -l
10

$ kubectl -n kyverno-smoke-test create configmap bad --from-literal=k=v
error: failed to create configmap: admission webhook "validate.kyverno.svc-fail" denied the request:
resource ConfigMap/kyverno-smoke-test/bad was blocked due to the following policies
smoke-test-require-owner-label:
  require-owner-label: 'validation error: ConfigMaps in kyverno-smoke-test must carry an owner label.'
--> PASS (enforcement working)

$ kubectl apply -f - (configmap "good" with owner=platform label)
configmap/good created
--> PASS (compliant resource admitted)

================================================================
UPGRADE — chart 3.8.2-dd4641f (Kyverno v1.18.2)
================================================================

$ kubectl get addon upbound-addon-kyverno
NAME                    INSTALLED   HEALTHY   PACKAGE                                               AGE
upbound-addon-kyverno   True        False     xpkg.upbound.io/upbound/addon-kyverno:3.8.2-dd4641f   36m
--> FAIL (first attempt): post-upgrade hooks failed: jobs.batch "kyverno-migrate-resources"
    is forbidden: User "system:serviceaccount:crossplane-system:upbound-controller-manager"
    cannot delete resource "jobs" in API group "batch" in the namespace "kyverno-system"

    NOT caused by this change. The migrate-resources hook is identical in charts
    3.6.2 / 3.7.0 / 3.8.2. This kind cluster was missing the job permissions that
    tests/e2etest-kyverno/main.k grants in CI (as cluster-admin). Fixed here with a
    narrow Role instead: batch/jobs get,list,watch,create,delete in kyverno-system.

$ kubectl get addon upbound-addon-kyverno     # after RBAC fix
NAME                    INSTALLED   HEALTHY   PACKAGE                                               AGE
upbound-addon-kyverno   True        True      xpkg.upbound.io/upbound/addon-kyverno:3.8.2-dd4641f   41m
--> PASS

$ kubectl get pods -n kyverno-system
kyverno-admission-controller-7757d78fb9-r8lcj    1/1   Running     0   78s
kyverno-background-controller-5fd9966f4b-tnm8z   1/1   Running     0   78s
kyverno-cleanup-controller-5f76ccf8cc-sh8dv      1/1   Running     0   78s
kyverno-migrate-resources-7nksv                  0/1   Completed   0   44s
kyverno-reports-controller-dd4d7d674-6pzjx       1/1   Running     0   78s

$ kubectl get pods -n kyverno-system -o jsonpath='{.items[*].spec.containers[0].image}' | tr ' ' '\n'
xpkg.upbound.io/upbound/kyverno:v1.18.2
xpkg.upbound.io/upbound/kyverno-background-controller:v1.18.2
xpkg.upbound.io/upbound/kyverno-cleanup-controller:v1.18.2
xpkg.upbound.io/upbound/kyverno-cli:v1.18.2
xpkg.upbound.io/upbound/kyverno-reports-controller:v1.18.2
--> PASS (all v1.18.2, all from xpkg.upbound.io)

$ kubectl get jobs -n kyverno-system
kyverno-migrate-resources   Complete   1/1   18s   44s
--> PASS (post-upgrade CRD migration; logs: "stored version is already up to date")

$ kubectl get clusterpolicy
NAME                             ADMISSION   BACKGROUND   READY   AGE   MESSAGE
smoke-test-require-owner-label   true        true         True    31m   Ready
--> PASS (survived the upgrade, still Ready)

$ kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep -c kyverno
10
--> PASS (same count as 3.7.0)

$ kubectl -n kyverno-smoke-test create configmap bad2 --from-literal=k=v
error: admission webhook "validate.kyverno.svc-fail" denied the request:
resource ConfigMap/kyverno-smoke-test/bad2 was blocked due to the following policies
--> PASS (enforcement still working after upgrade)

$ kubectl apply -f - (configmap "good2" with owner=platform label)
configmap/good2 created
--> PASS

NOTE — behaviour change, not a packaging issue:
  spec.background on the ClusterPolicy read "false" on v1.17.0 and reads "true" on
  v1.18.2. Re-applying the manifest with an explicit "background: false" still stores
  "true", so 1.18.2 is overriding it. Upstream Kyverno behaviour, unrelated to this PR,
  but relevant to anyone who deliberately disables background scans.

I have:

• Read and followed Upbound's contribution process.
  - [ ] Run make reviewable to ensure this PR is ready for review.
  - [ ] Added backport release-x.y labels to auto-backport this PR, as appropriate.