Preserve severity in every Kyverno controller log #4919

🤖 Generated by the Agentic Engineer

Description

Kyverno's reports controller still emits colored text logs. Coroot classifies informational API deprecation notices as fatal, so its application health view reports errors that the producer did not emit at that severity. The earlier admission-only structured logging repair in #4889 does not cover this producer.

Steps to Reproduce

1. Observe the reports controller's timestamped messages in Coroot on 15 October, including the 14:18–14:20 UTC deprecation notices.
2. Compare their explicit INF producer level with the fatal classification in the log consumer.
3. Render the committed Kyverno chart: admission uses JSON, while the remaining controllers still use colored text.

Expected Behavior

Structured severity must survive the CRI/log-consumer boundary for every controller. Keep the same verbosity, complete message and attributes, and genuine warning/error/fatal reporting. Deprecation notices remain visible; migrating deprecated APIs is separate work, not a reason to suppress them here.

Acceptance Criteria

• Reproduce the uncovered controller formatter failure before changing configuration, using the actual pinned chart and log consumer.
• Render all four controller producers and prove only the intended formatter changes; preserve verbosity and every other argument.
• Exercise informational deprecation notices and real warning, error and fatal levels through the deployed consumer, retaining their contents.
• Validate both platform overlays and the affected actual chart/post-renderers; preserve admission scope, failure policies and security configuration.
• Pass exact-head review and CI, merge through the production queue, then record separated live producer and Coroot readbacks. Do not erase old events or weaken checks.

Additional Context

This is a confirmed live observability defect, not evidence that the reported controller is crashing. A bounded Expedite WIP exception covers only completing the existing Kyverno log-severity repair across its remaining producers while the already-reviewed retirement preflight is in the merge queue. No unrelated migration or new mechanism is included. Priority High reflects misleading fatal incident signals; Effort Low includes native regressions, review, deployment and readback. Related to #4888 and #4889.

Delivery: #4920 merged on 2026-10-15 at e66d5a06f2ac7e601cabe4b0adbb06d37711c948. Merge-group CI 38765983857 and its protected production deployment succeeded. Separated OIDC readbacks confirm the accepted artifact is verified and Ready, all four controllers use JSON without changing verbosity, and all eight replicas are Ready.

Live acceptance: A fresh bounded producer sample at 17:11 UTC contains 332 informational and 13,412 genuine error records, all valid structured JSON. Coroot also displays post-rollout watcher failures as errors; those are the distinct root-cause defect tracked in #4929, not informational notices to suppress. A separated live consumer readback at 17:16 UTC shows the identical 17:10:24 UTC deprecation record as INFO (confirmed against Coroot's INFO legend), matching its producer JSON level. Genuine watcher failures retain ERROR classification. This completes formatter acceptance, not platform-wide clean-state verification. No historical events, filters, thresholds or permissions were changed.