41 lines
1.3 KiB
YAML
41 lines
1.3 KiB
YAML
|
apiVersion: kyverno.io/v2
|
||
|
|
kind: PolicyException
|
||
|
|
metadata:
|
||
|
|
name: quay-operator
|
||
|
|
namespace: kyverno
|
||
|
|
annotations:
|
||
|
|
policies.kyverno.io/reason: >-
|
||
|
|
Quay Operator CSV does not expose pod template labels or a strict
|
||
|
|
securityContext for the operator deployment. Prefer exception over
|
||
|
|
forked CSV until operator supports these fields.
|
||
|
|
quorate.internal/exception-owner: platform
|
||
|
|
quorate.internal/exception-review-by: "2026-10-11"
|
||
|
|
spec:
|
||
|
|
exceptions:
|
||
|
|
- policyName: require-app-labels
|
||
|
|
ruleNames:
|
||
|
|
- require-app-name-and-instance
|
||
|
|
- autogen-require-app-name-and-instance
|
||
|
|
- policyName: require-drop-all-capabilities
|
||
|
|
ruleNames:
|
||
|
|
- require-capabilities-drop-all
|
||
|
|
- autogen-require-capabilities-drop-all
|
||
|
|
- policyName: require-allow-privilege-escalation-false
|
||
|
|
ruleNames:
|
||
|
|
- require-allow-privilege-escalation-false
|
||
|
|
- autogen-require-allow-privilege-escalation-false
|
||
|
|
- policyName: require-resource-requests
|
||
|
|
ruleNames:
|
||
|
|
- require-cpu-memory-requests
|
||
|
|
- autogen-require-cpu-memory-requests
|
||
|
|
match:
|
||
|
|
any:
|
||
|
|
- resources:
|
||
|
|
kinds:
|
||
|
|
- Pod
|
||
|
|
- Deployment
|
||
|
|
- ReplicaSet
|
||
|
|
namespaces:
|
||
|
|
- quay
|
||
|
|
names:
|
||
|
|
- quay-operator-tng*
|