43 lines
1.4 KiB
YAML
43 lines
1.4 KiB
YAML
|
apiVersion: kyverno.io/v2
|
||
|
|
kind: PolicyException
|
||
|
|
metadata:
|
||
|
|
name: smartctl-exporter-host-smart
|
||
|
|
namespace: kyverno
|
||
|
|
annotations:
|
||
|
|
policies.kyverno.io/reason: >-
|
||
|
|
Host SMART metrics require privileged access to /dev on this cluster;
|
||
|
|
least-privilege (SYS_RAWIO alone) failed open-device EPERM. Track for
|
||
|
|
runtime controls (e.g. Tetragon) rather than silent privileged sprawl.
|
||
|
|
quorate.internal/exception-owner: platform
|
||
|
|
quorate.internal/exception-review-by: "2026-10-11"
|
||
|
|
spec:
|
||
|
|
exceptions:
|
||
|
|
- policyName: deny-privileged
|
||
|
|
ruleNames:
|
||
|
|
- deny-privileged-containers
|
||
|
|
- autogen-deny-privileged-containers
|
||
|
|
- policyName: require-drop-all-capabilities
|
||
|
|
ruleNames:
|
||
|
|
- require-capabilities-drop-all
|
||
|
|
- autogen-require-capabilities-drop-all
|
||
|
|
- policyName: require-allow-privilege-escalation-false
|
||
|
|
ruleNames:
|
||
|
|
- require-allow-privilege-escalation-false
|
||
|
|
- autogen-require-allow-privilege-escalation-false
|
||
|
|
- policyName: restrict-pod-host-access
|
||
|
|
ruleNames:
|
||
|
|
- deny-host-namespaces
|
||
|
|
- deny-hostpath-volumes
|
||
|
|
- autogen-deny-host-namespaces
|
||
|
|
- autogen-deny-hostpath-volumes
|
||
|
|
match:
|
||
|
|
any:
|
||
|
|
- resources:
|
||
|
|
kinds:
|
||
|
|
- Pod
|
||
|
|
- DaemonSet
|
||
|
|
- ReplicaSet
|
||
|
|
namespaces:
|
||
|
|
- smartctl-exporter
|
||
|
|
names:
|
||
|
|
- smartctl-exporter*
|