================================================================
BASELINE — chart 3.7.0 (Kyverno v1.17.0)
================================================================

$ kubectl get addon upbound-addon-kyverno
NAME                    INSTALLED   HEALTHY   PACKAGE                                       AGE
upbound-addon-kyverno   True        True      xpkg.upbound.io/upbound/addon-kyverno:3.7.0   26m

$ kubectl get pods -n kyverno-system
kyverno-admission-controller-656659959b-b4ssl    1/1   Running   0   26m
kyverno-background-controller-798f4744cc-zvhwj   1/1   Running   0   26m
kyverno-cleanup-controller-cccd59d76-g9lvd       1/1   Running   0   26m
kyverno-reports-controller-74c87bcf46-96trq      1/1   Running   0   26m

$ kubectl get pods -n kyverno-system -o jsonpath='{.items[*].spec.containers[0].image}' | tr ' ' '\n'
xpkg.upbound.io/upbound/kyverno:v1.17.0
xpkg.upbound.io/upbound/kyverno-background-controller:v1.17.0
xpkg.upbound.io/upbound/kyverno-cleanup-controller:v1.17.0
xpkg.upbound.io/upbound/kyverno-reports-controller:v1.17.0

$ kubectl get clusterpolicy
NAME                             ADMISSION   BACKGROUND   READY   AGE     MESSAGE
smoke-test-require-owner-label   true        true        True    2m15s   Ready

$ kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep kyverno | wc -l
10

$ kubectl -n kyverno-smoke-test create configmap bad --from-literal=k=v
error: failed to create configmap: admission webhook "validate.kyverno.svc-fail" denied the request:
resource ConfigMap/kyverno-smoke-test/bad was blocked due to the following policies
smoke-test-require-owner-label:
  require-owner-label: 'validation error: ConfigMaps in kyverno-smoke-test must carry an owner label.'
--> PASS (enforcement working)

$ kubectl apply -f - (configmap "good" with owner=platform label)
configmap/good created
--> PASS (compliant resource admitted)

================================================================
UPGRADE — chart 3.8.2-dd4641f (Kyverno v1.18.2)
================================================================

$ kubectl get addon upbound-addon-kyverno
NAME                    INSTALLED   HEALTHY   PACKAGE                                               AGE
upbound-addon-kyverno   True        False     xpkg.upbound.io/upbound/addon-kyverno:3.8.2-dd4641f   36m
--> FAIL (first attempt): post-upgrade hooks failed: jobs.batch "kyverno-migrate-resources"
    is forbidden: User "system:serviceaccount:crossplane-system:upbound-controller-manager"
    cannot delete resource "jobs" in API group "batch" in the namespace "kyverno-system"

    NOT caused by this change. The migrate-resources hook is identical in charts
    3.6.2 / 3.7.0 / 3.8.2. This kind cluster was missing the job permissions that
    tests/e2etest-kyverno/main.k grants in CI (as cluster-admin). Fixed here with a
    narrow Role instead: batch/jobs get,list,watch,create,delete in kyverno-system.

$ kubectl get addon upbound-addon-kyverno     # after RBAC fix
NAME                    INSTALLED   HEALTHY   PACKAGE                                               AGE
upbound-addon-kyverno   True        True      xpkg.upbound.io/upbound/addon-kyverno:3.8.2-dd4641f   41m
--> PASS

$ kubectl get pods -n kyverno-system
kyverno-admission-controller-7757d78fb9-r8lcj    1/1   Running     0   78s
kyverno-background-controller-5fd9966f4b-tnm8z   1/1   Running     0   78s
kyverno-cleanup-controller-5f76ccf8cc-sh8dv      1/1   Running     0   78s
kyverno-migrate-resources-7nksv                  0/1   Completed   0   44s
kyverno-reports-controller-dd4d7d674-6pzjx       1/1   Running     0   78s

$ kubectl get pods -n kyverno-system -o jsonpath='{.items[*].spec.containers[0].image}' | tr ' ' '\n'
xpkg.upbound.io/upbound/kyverno:v1.18.2
xpkg.upbound.io/upbound/kyverno-background-controller:v1.18.2
xpkg.upbound.io/upbound/kyverno-cleanup-controller:v1.18.2
xpkg.upbound.io/upbound/kyverno-cli:v1.18.2
xpkg.upbound.io/upbound/kyverno-reports-controller:v1.18.2
--> PASS (all v1.18.2, all from xpkg.upbound.io)

$ kubectl get jobs -n kyverno-system
kyverno-migrate-resources   Complete   1/1   18s   44s
--> PASS (post-upgrade CRD migration; logs: "stored version is already up to date")

$ kubectl get clusterpolicy
NAME                             ADMISSION   BACKGROUND   READY   AGE   MESSAGE
smoke-test-require-owner-label   true        true         True    31m   Ready
--> PASS (survived the upgrade, still Ready)

$ kubectl get validatingwebhookconfigurations,mutatingwebhookconfigurations | grep -c kyverno
10
--> PASS (same count as 3.7.0)

$ kubectl -n kyverno-smoke-test create configmap bad2 --from-literal=k=v
error: admission webhook "validate.kyverno.svc-fail" denied the request:
resource ConfigMap/kyverno-smoke-test/bad2 was blocked due to the following policies
--> PASS (enforcement still working after upgrade)

$ kubectl apply -f - (configmap "good2" with owner=platform label)
configmap/good2 created
--> PASS

NOTE — behaviour change, not a packaging issue:
  spec.background on the ClusterPolicy read "false" on v1.17.0 and reads "true" on
  v1.18.2. Re-applying the manifest with an explicit "background: false" still stores
  "true", so 1.18.2 is overriding it. Upstream Kyverno behaviour, unrelated to this PR,
  but relevant to anyone who deliberately disables background scans.