apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: smartctl-exporter-host-smart
  namespace: kyverno
  annotations:
    policies.kyverno.io/reason: >-
      Host SMART metrics require privileged access to /dev on this cluster;
      least-privilege (SYS_RAWIO alone) failed open-device EPERM. Track for
      runtime controls (e.g. Tetragon) rather than silent privileged sprawl.
    quorate.internal/exception-owner: platform
    quorate.internal/exception-review-by: "2026-10-11"
spec:
  exceptions:
    - policyName: deny-privileged
      ruleNames:
        - deny-privileged-containers
        - autogen-deny-privileged-containers
    - policyName: require-drop-all-capabilities
      ruleNames:
        - require-capabilities-drop-all
        - autogen-require-capabilities-drop-all
    - policyName: require-allow-privilege-escalation-false
      ruleNames:
        - require-allow-privilege-escalation-false
        - autogen-require-allow-privilege-escalation-false
    - policyName: restrict-pod-host-access
      ruleNames:
        - deny-host-namespaces
        - deny-hostpath-volumes
        - autogen-deny-host-namespaces
        - autogen-deny-hostpath-volumes
  match:
    any:
      - resources:
          kinds:
            - Pod
            - DaemonSet
            - ReplicaSet
          namespaces:
            - smartctl-exporter
          names:
            - smartctl-exporter*