apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: rancher-exemption
  namespace: kyverno
spec:
  exceptions:
    - policyName: restrict-image-registries
      ruleNames:
        - validate-container-registries
        - autogen-validate-container-registries
        - autogen-cronjob-validate-container-registries
    - policyName: require-drop-all-capabilities
      ruleNames:
        - require-drop-all
        - autogen-require-drop-all
        - autogen-cronjob-require-drop-all
    - policyName: require-resource-limits
      ruleNames:
        - require-limits
        - autogen-require-limits
        - autogen-cronjob-require-limits
    - policyName: disallow-automount-sa-token
      ruleNames:
        - validate-automount
        - autogen-validate-automount
        - autogen-cronjob-validate-automount
    - policyName: require-app-label
      ruleNames:
        - require-app-label
    - policyName: require-probes
      ruleNames:
        - require-probes
    - policyName: disallow-latest-tag
      ruleNames:
        - disallow-latest
        - autogen-disallow-latest
        - autogen-cronjob-disallow-latest
    - policyName: require-non-root
      ruleNames:
        - require-run-as-non-root
        - autogen-require-run-as-non-root
        - autogen-cronjob-require-run-as-non-root
    - policyName: require-readonly-rootfs
      ruleNames:
        - require-ro-rootfs
        - autogen-require-ro-rootfs
        - autogen-cronjob-require-ro-rootfs
    - policyName: disallow-default-namespace
      ruleNames:
        - validate-namespace
        - autogen-validate-namespace
        - autogen-cronjob-validate-namespace
  match:
    any:
      - resources:
          namespaces:
            - cattle-system
            - cattle-fleet-system
            - cattle-fleet-local-system
            - cattle-capi-system
            - cattle-turtles-system
            - cattle-ui-plugin-system
            - cattle-impersonation-system
            - cattle-global-data
            - cattle-local-user-passwords
            - cattle-fleet-clusters-system
            - fleet-default
            - fleet-local
            - cluster-fleet-*