apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: authentik-exemption
  namespace: kyverno
spec:
  exceptions:
    - policyName: disallow-automount-sa-token
      ruleNames:
        - validate-automount
        - autogen-validate-automount
  match:
    any:
      - resources:
          kinds:
            - Deployment
            - ReplicaSet
            - Pod
          namespaces:
            - authentik
          names:
            - authentik-server*
            - authentik-worker*
            - pg-authentik*