Repository navigation
fix(kyverno): keep the local test-bed working on arm64 with amd64-only patched images #5639
Description
🤖 Generated by the Agentic Engineer
Problem and evidence
The local test-bed installs Kyverno from the same base release as production. Two of its images are now our own patched builds, and both publishers build linux/amd64 only (publish-kyverno-migration-runtime.yaml, publish-kyverno-background-hotfix.yaml). The migration image landed in #5637 and the background controller follows in #5638.
On an arm64 host, such as an Apple Silicon Mac running ksail cluster create, those Pods should fail to pull a matching image. This comes from reading the publishers and has not been run on an arm64 cluster.
Hypothesis and smallest useful change
Either publish both images for linux/arm64 too, or have the Docker provider overlay keep the upstream images, which are multi-architecture. Publishing both keeps local closer to production but needs its own signature and scan checks on each architecture. The overlay is smaller but means local runs without these fixes.
Acceptance
- An arm64 local cluster brings up all Kyverno controllers and finishes the migration hook.
- Production's pinned images and signature rules are unchanged, or any change is separately reviewed.
Activity
coderabbitai commentedon Oct 31, 2026
🔗 Related PRs
#5532 - fix(kyverno): prepare hardened idempotent cleanup image [merged]
#5544 - fix(kyverno): prepare patched migration runtime [merged]
📝 Issue Planner
Check the box below or use the
@coderabbitai plancommand to generate an implementation plan and prompts that you can use with your favorite coding assistant.🧪 Issue enrichment is currently in open beta.
You can configure auto-planning by selecting labels in the issue_enrichment configuration.
To disable automatic issue enrichment, add the following to your
.coderabbit.yaml:💬 Have feedback or questions? Drop into our discord!