apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: node-exporter-host-metrics
  namespace: kyverno
  annotations:
    policies.kyverno.io/reason: >-
      Node exporter needs hostNetwork and hostPath mounts for node metrics.
      Privileged is already avoided; host access is residual for this DaemonSet.
    quorate.internal/exception-owner: platform
    quorate.internal/exception-review-by: "2026-10-11"
spec:
  exceptions:
    - policyName: restrict-pod-host-access
      ruleNames:
        - deny-host-namespaces
        - deny-hostpath-volumes
        - autogen-deny-host-namespaces
        - autogen-deny-hostpath-volumes
  match:
    any:
      - resources:
          kinds:
            - Pod
            - DaemonSet
            - ReplicaSet
          namespaces:
            - node-exporter
          names:
            - node-exporter*