Initial commit

infrastructure/kyverno/policies/rancher-exception.yaml

@@ -0,0 +1,70 @@
+apiVersion: kyverno.io/v2
+kind: PolicyException
+metadata:
+  name: rancher-exemption
+  namespace: kyverno
+spec:
+  exceptions:
+    - policyName: restrict-image-registries
+      ruleNames:
+        - validate-container-registries
+        - autogen-validate-container-registries
+        - autogen-cronjob-validate-container-registries
+    - policyName: require-drop-all-capabilities
+      ruleNames:
+        - require-drop-all
+        - autogen-require-drop-all
+        - autogen-cronjob-require-drop-all
+    - policyName: require-resource-limits
+      ruleNames:
+        - require-limits
+        - autogen-require-limits
+        - autogen-cronjob-require-limits
+    - policyName: disallow-automount-sa-token
+      ruleNames:
+        - validate-automount
+        - autogen-validate-automount
+        - autogen-cronjob-validate-automount
+    - policyName: require-app-label
+      ruleNames:
+        - require-app-label
+    - policyName: require-probes
+      ruleNames:
+        - require-probes
+    - policyName: disallow-latest-tag
+      ruleNames:
+        - disallow-latest
+        - autogen-disallow-latest
+        - autogen-cronjob-disallow-latest
+    - policyName: require-non-root
+      ruleNames:
+        - require-run-as-non-root
+        - autogen-require-run-as-non-root
+        - autogen-cronjob-require-run-as-non-root
+    - policyName: require-readonly-rootfs
+      ruleNames:
+        - require-ro-rootfs
+        - autogen-require-ro-rootfs
+        - autogen-cronjob-require-ro-rootfs
+    - policyName: disallow-default-namespace
+      ruleNames:
+        - validate-namespace
+        - autogen-validate-namespace
+        - autogen-cronjob-validate-namespace
+  match:
+    any:
+      - resources:
+          namespaces:
+            - cattle-system
+            - cattle-fleet-system
+            - cattle-fleet-local-system
+            - cattle-capi-system
+            - cattle-turtles-system
+            - cattle-ui-plugin-system
+            - cattle-impersonation-system
+            - cattle-global-data
+            - cattle-local-user-passwords
+            - cattle-fleet-clusters-system
+            - fleet-default
+            - fleet-local
+            - cluster-fleet-*