30 lines
862 B
YAML
30 lines
862 B
YAML
|
apiVersion: kyverno.io/v2
|
||
|
|
kind: PolicyException
|
||
|
|
metadata:
|
||
|
|
name: node-exporter-host-metrics
|
||
|
|
namespace: kyverno
|
||
|
|
annotations:
|
||
|
|
policies.kyverno.io/reason: >-
|
||
|
|
Node exporter needs hostNetwork and hostPath mounts for node metrics.
|
||
|
|
Privileged is already avoided; host access is residual for this DaemonSet.
|
||
|
|
quorate.internal/exception-owner: platform
|
||
|
|
quorate.internal/exception-review-by: "2026-10-11"
|
||
|
|
spec:
|
||
|
|
exceptions:
|
||
|
|
- policyName: restrict-pod-host-access
|
||
|
|
ruleNames:
|
||
|
|
- deny-host-namespaces
|
||
|
|
- deny-hostpath-volumes
|
||
|
|
- autogen-deny-host-namespaces
|
||
|
|
- autogen-deny-hostpath-volumes
|
||
|
|
match:
|
||
|
|
any:
|
||
|
|
- resources:
|
||
|
|
kinds:
|
||
|
|
- Pod
|
||
|
|
- DaemonSet
|
||
|
|
- ReplicaSet
|
||
|
|
namespaces:
|
||
|
|
- node-exporter
|
||
|
|
names:
|
||
|
|
- node-exporter*
|