apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: zfs-exporter-host-zfs
  namespace: kyverno
  annotations:
    policies.kyverno.io/reason: >-
      Host ZFS metrics need chart-level privileged + host root path for libzfs
      under chroot on this cluster; least-privilege probes failed. Track for
      runtime controls (e.g. Tetragon).
    quorate.internal/exception-owner: platform
    quorate.internal/exception-review-by: "2026-10-11"
spec:
  exceptions:
    - policyName: deny-privileged
      ruleNames:
        - deny-privileged-containers
        - autogen-deny-privileged-containers
    - policyName: require-drop-all-capabilities
      ruleNames:
        - require-capabilities-drop-all
        - autogen-require-capabilities-drop-all
    - policyName: require-allow-privilege-escalation-false
      ruleNames:
        - require-allow-privilege-escalation-false
        - autogen-require-allow-privilege-escalation-false
    - policyName: restrict-pod-host-access
      ruleNames:
        - deny-host-namespaces
        - deny-hostpath-volumes
        - autogen-deny-host-namespaces
        - autogen-deny-hostpath-volumes
  match:
    any:
      - resources:
          kinds:
            - Pod
            - DaemonSet
            - ReplicaSet
          namespaces:
            - zfs-exporter
          names:
            - zfs-exporter*