Fix ArgoCD ServerSideDiff permanent OutOfSync diffs

Add explicit CRD/API defaults to manifests that were causing ArgoCD's
SSA dry-run to produce results different from live state:

- HTTPRoutes: add group, kind, weight defaults to parentRefs/backendRefs
- Kyverno ClusterPolicies: add skipBackgroundRequests, allowExistingViolations
- Tetragon TracingPolicies: add return, maxData, resolve, returnCopy defaults
- Gateway certificateRefs: add group="" default
- Guacamole Gateway: add group="" to certificateRefs

Add ignoreDifferences for resources that legitimately differ:
- Cilium cert Secrets (auto-generated, data always differs)
- Istio ValidatingWebhookConfiguration failurePolicy (istiod mutates)
- Crowdsec LAPI Secrets (randomly generated)
- ServiceMonitor/PodMonitor relabeling action defaults
- StatefulSet volumeClaimTemplates apiVersion/kind defaults

Persist argocd-cm ignoreDifferences config in ArgoCD Helm values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

infrastructure/kyverno/policies/disallow-automount-sa-token.yaml

@@ -16,6 +16,7 @@ spec:
   background: true
   rules:
     - name: validate-automount
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -60,6 +61,7 @@ spec:
                 - n8n
                 - nessus
       validate:
+        allowExistingViolations: true
         message: >-
           Pods should set automountServiceAccountToken to false unless API
           access is required (STIG V-242382).

infrastructure/kyverno/policies/disallow-default-namespace.yaml

@@ -14,6 +14,7 @@ spec:
   background: true
   rules:
     - name: validate-namespace
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -27,6 +28,7 @@ spec:
               namespaces:
                 - default
       validate:
+        allowExistingViolations: true
         message: >-
           Workloads must not run in the default namespace (STIG V-242383).
           Create a dedicated namespace for your application.

infrastructure/kyverno/policies/disallow-host-namespaces.yaml

@@ -15,6 +15,7 @@ spec:
   background: true
   rules:
     - name: host-namespaces
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -31,6 +32,7 @@ spec:
                 - kyverno
                 - crowdsec
       validate:
+        allowExistingViolations: true
         message: >-
           Sharing host PID, IPC, or network namespaces is not allowed (STIG V-242386).
         pattern:

infrastructure/kyverno/policies/disallow-latest-tag.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: disallow-latest
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -25,6 +26,7 @@ spec:
                 - crowdsec
                 - home-assistant
       validate:
+        allowExistingViolations: true
         message: "Using ':latest' image tag is not allowed. Specify an explicit tag."
         pattern:
           spec:

infrastructure/kyverno/policies/disallow-nodeport.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: disallow-nodeport
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -23,6 +24,7 @@ spec:
                 - kube-system
                 - istio-system
       validate:
+        allowExistingViolations: true
         message: "NodePort services are not allowed. Use ClusterIP or LoadBalancer."
         pattern:
           spec:

infrastructure/kyverno/policies/disallow-privileged.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: disallow-privileged
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -29,6 +30,7 @@ spec:
                 - tetragon
                 - crowdsec
       validate:
+        allowExistingViolations: true
         message: "Privileged containers are not allowed."
         pattern:
           spec:

infrastructure/kyverno/policies/require-drop-all-capabilities.yaml

@@ -15,6 +15,7 @@ spec:
   background: true
   rules:
     - name: require-drop-all
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -55,6 +56,7 @@ spec:
                 - checkov
                 - external-secrets
       validate:
+        allowExistingViolations: true
         message: >-
           Containers must drop ALL capabilities (STIG V-242398).
           Add securityContext.capabilities.drop: ["ALL"] to each container.

infrastructure/kyverno/policies/require-istio-ambient.yaml

@@ -14,6 +14,7 @@ spec:
   background: true
   rules:
     - name: check-namespace-ambient-label
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -74,6 +75,7 @@ spec:
                 - user-*
                 - cluster-fleet-*
       validate:
+        allowExistingViolations: true
         message: "Application namespaces must have istio.io/dataplane-mode=ambient for zero-trust mTLS."
         pattern:
           metadata:

infrastructure/kyverno/policies/require-labels.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-app-label
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -33,6 +34,7 @@ spec:
                 - scylla-operator
                 - cert-manager
       validate:
+        allowExistingViolations: true
         message: "The label 'app' or 'app.kubernetes.io/name' is required."
         anyPattern:
           - metadata:

infrastructure/kyverno/policies/require-non-root.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-run-as-non-root
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -27,6 +28,7 @@ spec:
                 - kyverno
                 - tetragon
       validate:
+        allowExistingViolations: true
         message: "Containers must run as non-root. Set runAsNonRoot to true."
         pattern:
           spec:

infrastructure/kyverno/policies/require-probes.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-probes
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -44,6 +45,7 @@ spec:
                 - nextcloud
                 - scylla-manager
       validate:
+        allowExistingViolations: true
         message: "Liveness and readiness probes are required for all containers."
         pattern:
           spec:

infrastructure/kyverno/policies/require-resource-limits.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-limits
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -53,6 +54,7 @@ spec:
                 - checkov
                 - scylla-manager
       validate:
+        allowExistingViolations: true
         message: "All containers must have CPU and memory limits defined."
         pattern:
           spec:

infrastructure/kyverno/policies/require-ro-rootfs.yaml

@@ -11,6 +11,7 @@ spec:
   background: true
   rules:
     - name: require-ro-rootfs
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -31,6 +32,7 @@ spec:
                 - nextcloud
                 - home-assistant
       validate:
+        allowExistingViolations: true
         message: "Containers should use a read-only root filesystem."
         pattern:
           spec:

infrastructure/kyverno/policies/restrict-image-registries.yaml

@@ -16,6 +16,7 @@ spec:
   background: true
   rules:
     - name: validate-container-registries
+      skipBackgroundRequests: true
       match:
         any:
           - resources:
@@ -29,6 +30,7 @@ spec:
                 - kube-node-lease
                 - kyverno
       validate:
+        allowExistingViolations: true
         message: >-
           Images must come from allowed registries: docker.io, ghcr.io, quay.io,
           registry.k8s.io, gcr.io, lscr.io, registry.gitlab.com, cr.fluentbit.io,