So.... a wise man suggested to me that I increase the timeouts, so I increased both the "Contact Node Timeout" and the "Policy Rollback Timeout" from 60 to 180. Policy push to all my clusters worked again!
Can I assume this would be normal for a policy push after dynamic update activation?
not normal as such, but if the update package added a lot of new situations and applications it might be expected. At least in the case where the engine hardware is not very high-end and the policy install time was already close to the timeout even before new package was activated. Then if the inspection config grows it goes slightly over the timeout and you get this. You can check from command line, the end of latest sgcfg-check-<timestamp> file in /data/diagnostics tells how long it took.
This makes sense, we are running clusters of NGF-325 so the hardware spec is not very high.
I will check the files you suggest!