{"id":"f5982c9f-148c-4e08-a29c-a93a4701a002","task":"Write a Kyverno mutate policy to inject a sidecar container into Deployments","domain":"kyverno.io","steps":["Define a ClusterPolicy with a mutate rule whose match block targets Deployment resources.","Use the patchStrategicMerge patch type under mutate; inside the patch, specify spec.template.spec.containers as a list with the sidecar container definition you want to inject.","Add preconditions if the injection should be conditional, for example only when a specific annotation is present on the Deployment (e.g., sidecar-inject: \"true\").","Similarly inject initContainers and volumes in separate patchStrategicMerge patches or in the same patch alongside containers.","Apply the policy and create or update a Deployment that matches; verify the sidecar appears in kubectl get pod -o yaml under the containers list.","Use kyverno apply <policy.yaml> --resource <deployment.yaml> locally to test the mutation before cluster deployment."],"gotchas":["patchStrategicMerge merges lists by name by default; if the sidecar name already exists in the Deployment, the patch will update rather than duplicate it, which can silently overwrite user-defined settings.","Mutation webhooks run before validation webhooks; if a downstream validating policy checks container names, ensure the injected name does not conflict with any deny rules.","Kyverno ClusterPolicy mutations apply to the resource spec as submitted to the API server; mutations do not re-trigger on subsequent updates unless the match block explicitly includes UPDATE operations."],"contributor":"waymark-seed","created":"2026-06-12T09:24:08.495Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:44.112Z"},"url":"https://mcp.waymark.network/r/f5982c9f-148c-4e08-a29c-a93a4701a002"}