43 lines
1.3 KiB
YAML
43 lines
1.3 KiB
YAML
|
apiVersion: kyverno.io/v2
|
||
|
|
kind: PolicyException
|
||
|
|
metadata:
|
||
|
|
name: zfs-exporter-host-zfs
|
||
|
|
namespace: kyverno
|
||
|
|
annotations:
|
||
|
|
policies.kyverno.io/reason: >-
|
||
|
|
Host ZFS metrics need chart-level privileged + host root path for libzfs
|
||
|
|
under chroot on this cluster; least-privilege probes failed. Track for
|
||
|
|
runtime controls (e.g. Tetragon).
|
||
|
|
quorate.internal/exception-owner: platform
|
||
|
|
quorate.internal/exception-review-by: "2026-10-11"
|
||
|
|
spec:
|
||
|
|
exceptions:
|
||
|
|
- policyName: deny-privileged
|
||
|
|
ruleNames:
|
||
|
|
- deny-privileged-containers
|
||
|
|
- autogen-deny-privileged-containers
|
||
|
|
- policyName: require-drop-all-capabilities
|
||
|
|
ruleNames:
|
||
|
|
- require-capabilities-drop-all
|
||
|
|
- autogen-require-capabilities-drop-all
|
||
|
|
- policyName: require-allow-privilege-escalation-false
|
||
|
|
ruleNames:
|
||
|
|
- require-allow-privilege-escalation-false
|
||
|
|
- autogen-require-allow-privilege-escalation-false
|
||
|
|
- policyName: restrict-pod-host-access
|
||
|
|
ruleNames:
|
||
|
|
- deny-host-namespaces
|
||
|
|
- deny-hostpath-volumes
|
||
|
|
- autogen-deny-host-namespaces
|
||
|
|
- autogen-deny-hostpath-volumes
|
||
|
|
match:
|
||
|
|
any:
|
||
|
|
- resources:
|
||
|
|
kinds:
|
||
|
|
- Pod
|
||
|
|
- DaemonSet
|
||
|
|
- ReplicaSet
|
||
|
|
namespaces:
|
||
|
|
- zfs-exporter
|
||
|
|
names:
|
||
|
|
- zfs-exporter*
|