apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: istio-waypoint-exemption
  namespace: kyverno
spec:
  exceptions:
    - policyName: require-app-label
      ruleNames:
        - require-app-label
    - policyName: require-probes
      ruleNames:
        - require-probes
    - policyName: disallow-automount-sa-token
      ruleNames:
        - validate-automount
        - autogen-validate-automount
    - policyName: require-drop-all-capabilities
      ruleNames:
        - require-drop-all
        - autogen-require-drop-all
    - policyName: require-resource-limits
      ruleNames:
        - require-limits
        - autogen-require-limits
    - policyName: require-non-root
      ruleNames:
        - require-run-as-non-root
        - autogen-require-run-as-non-root
    - policyName: require-readonly-rootfs
      ruleNames:
        - require-ro-rootfs
        - autogen-require-ro-rootfs
    - policyName: disallow-latest-tag
      ruleNames:
        - disallow-latest
        - autogen-disallow-latest
  match:
    any:
      - resources:
          kinds:
            - Deployment
            - ReplicaSet
            - Pod
          selector:
            matchLabels:
              gateway.networking.k8s.io/gateway-name: waypoint