Fix race condition: Kyverno policy now only triggers on CREATE

Added operations: [CREATE] filter to all 4 rules in the VolSync
backup/restore policy. Without this filter, Kyverno intercepted
all PVC operations including DELETE, preventing PVC deletion
and causing race conditions.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: mitchross

docs/backup-restore.md

@@ -42,6 +42,7 @@ The system automatically backs up PVCs to S3-compatible storage (RustFS/MinIO) a
 
 ### 3. Kyverno ClusterPolicy
 - Triggers on PVCs with label `backup: hourly` or `backup: daily`
+- **Only triggers on CREATE operations** (not UPDATE/DELETE) to avoid race conditions
 - Calls pvc-plumber to check for existing backups
 - Generates:
   - ExternalSecret (per-PVC S3 credentials)

infrastructure/controllers/kyverno/policies/volsync-pvc-backup-restore.yaml

@@ -177,12 +177,15 @@ spec:
                 fsGroup: 568
 
     # Rule 4: Generate ReplicationDestination (restore capability)
+    # IMPORTANT: Only trigger on CREATE to avoid race conditions during PVC deletion
     - name: generate-replication-destination
       match:
         any:
           - resources:
               kinds:
                 - PersistentVolumeClaim
+              operations:
+                - CREATE
               selector:
                 matchExpressions:
                   - key: backup