Recover stale Kyverno Helm operations

bootstrap/platform/main.tf

@@ -1399,8 +1399,37 @@ EOT
   }
 }
 
-resource "helm_release" "kyverno" {
+resource "null_resource" "kyverno_helm_recovery" {
   depends_on = [null_resource.calico_ready]
+
+  triggers = {
+    kubeconfig_path = var.kubeconfig_path
+    namespace       = var.kyverno.namespace
+    release_name    = "kyverno"
+    release_version = var.kyverno.chart_version
+  }
+
+  provisioner "local-exec" {
+    interpreter = ["/bin/bash", "-lc"]
+    command     = <<EOT
+set -euo pipefail
+
+kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" get secrets \
+  -l "owner=helm,name=${self.triggers.release_name}" \
+  -o jsonpath='{range .items[*]}{.metadata.name}{"\t"}{.metadata.labels.status}{"\n"}{end}' 2>/dev/null |
+while IFS=$'\t' read -r secret status; do
+  case "$status" in
+    pending-install|pending-upgrade|pending-rollback|failed|uninstalling)
+      kubectl --kubeconfig "${self.triggers.kubeconfig_path}" -n "${self.triggers.namespace}" delete secret "$secret"
+      ;;
+  esac
+done
+EOT
+  }
+}
+
+resource "helm_release" "kyverno" {
+  depends_on       = [null_resource.kyverno_helm_recovery]
   name             = "kyverno"
   repository       = var.kyverno.repository
   chart            = "kyverno"