Initial commit

infrastructure/kyverno/policies/istio-waypoint-exception.yaml

@@ -0,0 +1,47 @@
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: istio-waypoint-exemption
+  namespace: kyverno
+spec:
+  exceptions:
+    - policyName: require-app-label
+      ruleNames:
+        - require-app-label
+    - policyName: require-probes
+      ruleNames:
+        - require-probes
+    - policyName: disallow-automount-sa-token
+      ruleNames:
+        - validate-automount
+        - autogen-validate-automount
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-drop-all
+        - autogen-require-drop-all
+    - policyName: require-resource-limits
+      ruleNames:
+        - require-limits
+        - autogen-require-limits
+    - policyName: require-non-root
+      ruleNames:
+        - require-run-as-non-root
+        - autogen-require-run-as-non-root
+    - policyName: require-readonly-rootfs
+      ruleNames:
+        - require-ro-rootfs
+        - autogen-require-ro-rootfs
+    - policyName: disallow-latest-tag
+      ruleNames:
+        - disallow-latest
+        - autogen-disallow-latest
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - ReplicaSet
+            - Pod
+          selector:
+            matchLabels:
+              gateway.networking.k8s.io/gateway-name: waypoint