# Scylla Manager and ScyllaDB upstream charts do not drop all
# capabilities and automount the SA token for cluster management.
apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: scylla-exemption
  namespace: kyverno
spec:
  exceptions:
    - policyName: require-drop-all-capabilities
      ruleNames:
        - require-drop-all
        - autogen-require-drop-all
    - policyName: disallow-automount-sa-token
      ruleNames:
        - validate-automount
        - autogen-validate-automount
  match:
    any:
      - resources:
          kinds:
            - Deployment
            - StatefulSet
            - ReplicaSet
            - Pod
          namespaces:
            - scylla-manager