ce7cb702218693d08ea6d83464d2457c9250027c

vendor/platform/kyverno/exceptions/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - quay-operator.yaml
+  - smartctl-exporter-host-smart.yaml
+  - zfs-exporter-host-zfs.yaml
+  - node-exporter-host-metrics.yaml

vendor/platform/kyverno/exceptions/node-exporter-host-metrics.yaml

@@ -0,0 +1,30 @@
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: node-exporter-host-metrics
+  namespace: kyverno
+  annotations:
+    policies.kyverno.io/reason: >-
+      Node exporter needs hostNetwork and hostPath mounts for node metrics.
+      Privileged is already avoided; host access is residual for this DaemonSet.
+    quorate.internal/exception-owner: platform
+    quorate.internal/exception-review-by: "2026-10-11"
+spec:
+  exceptions:
+    - policyName: restrict-pod-host-access
+      ruleNames:
+        - deny-host-namespaces
+        - deny-hostpath-volumes
+        - autogen-deny-host-namespaces
+        - autogen-deny-hostpath-volumes
+  match:
+    any:
+      - resources:
+          kinds:
+            - Pod
+            - DaemonSet
+            - ReplicaSet
+          namespaces:
+            - node-exporter
+          names:
+            - node-exporter*

vendor/platform/kyverno/exceptions/quay-operator.yaml

@@ -0,0 +1,41 @@
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: quay-operator
+  namespace: kyverno
+  annotations:
+    policies.kyverno.io/reason: >-
+      Quay Operator CSV does not expose pod template labels or a strict
+      securityContext for the operator deployment. Prefer exception over
+      forked CSV until operator supports these fields.
+    quorate.internal/exception-owner: platform
+    quorate.internal/exception-review-by: "2026-10-11"
+spec:
+  exceptions:
+    - policyName: require-app-labels
+      ruleNames:
+        - require-app-name-and-instance
+        - autogen-require-app-name-and-instance
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-capabilities-drop-all
+        - autogen-require-capabilities-drop-all
+    - policyName: require-allow-privilege-escalation-false
+      ruleNames:
+        - require-allow-privilege-escalation-false
+        - autogen-require-allow-privilege-escalation-false
+    - policyName: require-resource-requests
+      ruleNames:
+        - require-cpu-memory-requests
+        - autogen-require-cpu-memory-requests
+  match:
+    any:
+      - resources:
+          kinds:
+            - Pod
+            - Deployment
+            - ReplicaSet
+          namespaces:
+            - quay
+          names:
+            - quay-operator-tng*

vendor/platform/kyverno/exceptions/smartctl-exporter-host-smart.yaml

@@ -0,0 +1,43 @@
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: smartctl-exporter-host-smart
+  namespace: kyverno
+  annotations:
+    policies.kyverno.io/reason: >-
+      Host SMART metrics require privileged access to /dev on this cluster;
+      least-privilege (SYS_RAWIO alone) failed open-device EPERM. Track for
+      runtime controls (e.g. Tetragon) rather than silent privileged sprawl.
+    quorate.internal/exception-owner: platform
+    quorate.internal/exception-review-by: "2026-10-11"
+spec:
+  exceptions:
+    - policyName: deny-privileged
+      ruleNames:
+        - deny-privileged-containers
+        - autogen-deny-privileged-containers
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-capabilities-drop-all
+        - autogen-require-capabilities-drop-all
+    - policyName: require-allow-privilege-escalation-false
+      ruleNames:
+        - require-allow-privilege-escalation-false
+        - autogen-require-allow-privilege-escalation-false
+    - policyName: restrict-pod-host-access
+      ruleNames:
+        - deny-host-namespaces
+        - deny-hostpath-volumes
+        - autogen-deny-host-namespaces
+        - autogen-deny-hostpath-volumes
+  match:
+    any:
+      - resources:
+          kinds:
+            - Pod
+            - DaemonSet
+            - ReplicaSet
+          namespaces:
+            - smartctl-exporter
+          names:
+            - smartctl-exporter*

vendor/platform/kyverno/exceptions/zfs-exporter-host-zfs.yaml

@@ -0,0 +1,43 @@
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: zfs-exporter-host-zfs
+  namespace: kyverno
+  annotations:
+    policies.kyverno.io/reason: >-
+      Host ZFS metrics need chart-level privileged + host root path for libzfs
+      under chroot on this cluster; least-privilege probes failed. Track for
+      runtime controls (e.g. Tetragon).
+    quorate.internal/exception-owner: platform
+    quorate.internal/exception-review-by: "2026-10-11"
+spec:
+  exceptions:
+    - policyName: deny-privileged
+      ruleNames:
+        - deny-privileged-containers
+        - autogen-deny-privileged-containers
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-capabilities-drop-all
+        - autogen-require-capabilities-drop-all
+    - policyName: require-allow-privilege-escalation-false
+      ruleNames:
+        - require-allow-privilege-escalation-false
+        - autogen-require-allow-privilege-escalation-false
+    - policyName: restrict-pod-host-access
+      ruleNames:
+        - deny-host-namespaces
+        - deny-hostpath-volumes
+        - autogen-deny-host-namespaces
+        - autogen-deny-hostpath-volumes
+  match:
+    any:
+      - resources:
+          kinds:
+            - Pod
+            - DaemonSet
+            - ReplicaSet
+          namespaces:
+            - zfs-exporter
+          names:
+            - zfs-exporter*