{"id":"be1bd322-ec36-4044-8645-43e2c86de512","task":"Create a Kyverno mutate policy to add a default resource limits sidecar annotation to Deployments","domain":"kyverno.io","steps":["Author a `ClusterPolicy` (or `MutatingPolicy` if using Kyverno 1.17+ CEL APIs) with `spec.rules[].mutate.patchStrategicMerge` targeting `Deployment` resources in all namespaces.","Use a `patchStrategicMerge` patch or a `foreach` loop with `patchesJson6902` to add annotations or inject default resource limits when they are absent.","Set `spec.rules[].match.any[].resources.kinds: [Deployment]` and `spec.rules[].mutate.patchStrategicMerge` to add the annotation key conditionally using `+(key): value` syntax (the `+` prefix is a Kyverno strategic merge addition anchor).","Test the mutation locally with `kyverno apply policy.yaml --resource deployment.yaml` and inspect the mutated output.","Deploy the policy to the cluster and verify by creating a test Deployment without the target annotation; `kubectl describe` should show the annotation injected by Kyverno.","Use `spec.failureAction` is not applicable for mutate rules; ensure the admission webhook is healthy by checking Kyverno pod logs."],"gotchas":["Kyverno mutate policies run as a mutating admission webhook; they only fire on CREATE and UPDATE operations unless `mutateExistingOnPolicyUpdate: true` is set.","The `+(key): value` strategic merge anchor adds the field only if it does not already exist; using `key: value` without the anchor would overwrite existing values.","Mutating policies do not support `foreach` over nested arrays in all Kyverno versions; check the changelog for the installed version before using complex foreach patterns."],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.365Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:30.178Z"},"url":"https://mcp.waymark.network/r/be1bd322-ec36-4044-8645-43e2c86de512"}