Operator fight with Kyverno: Labels on Pods

[mihaigalos]

What did you do to encounter the bug?
Steps to reproduce the behavior:

• Deploy Kyverno to project
• Use a mutating policy to add a label to a pod - example
• Deploy the Community operator to project
• there is an operator fight between Kyvero and the MongoDB operator which produced Kyverno UpdateRequests:

1. the MongoDB is hard-coding labels in the StatefulSet generation logic.
2. Kyverno mutates/adds labels
3. the operator tries to reconcile with the StatefulSet .spec.template.metadata.labels -> so it will try to revert the Kyverno changes to the previous form, which triggers Kyverno again in step 2.

What did you expect?
No fight between Kyverno and the MongoDB Community operator: No UpdateRequest CRs produced in the cluster.

What happened instead?
Operator fight in the steps 2 and 3 described above.

Screenshots

Operator Information

• Operator Version: main, commit f6a53c96128e3e998f4c274964876206ce409305
• MongoDB Image used: main

Kubernetes Cluster Information

• Distribution: OKD
• Version: v4.19
• Image Registry location (quay, or an internal registry)