apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: quay-operator
  namespace: kyverno
  annotations:
    policies.kyverno.io/reason: >-
      Quay Operator CSV does not expose pod template labels or a strict
      securityContext for the operator deployment. Prefer exception over
      forked CSV until operator supports these fields.
    quorate.internal/exception-owner: platform
    quorate.internal/exception-review-by: "2026-10-11"
spec:
  exceptions:
    - policyName: require-app-labels
      ruleNames:
        - require-app-name-and-instance
        - autogen-require-app-name-and-instance
    - policyName: require-drop-all-capabilities
      ruleNames:
        - require-capabilities-drop-all
        - autogen-require-capabilities-drop-all
    - policyName: require-allow-privilege-escalation-false
      ruleNames:
        - require-allow-privilege-escalation-false
        - autogen-require-allow-privilege-escalation-false
    - policyName: require-resource-requests
      ruleNames:
        - require-cpu-memory-requests
        - autogen-require-cpu-memory-requests
  match:
    any:
      - resources:
          kinds:
            - Pod
            - Deployment
            - ReplicaSet
          namespaces:
            - quay
          names:
            - quay-operator-tng*