# NetBird operator upstream chart does not set resource limits and
# automounts the SA token for Kubernetes API access.
apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: netbird-operator-exemption
  namespace: kyverno
spec:
  exceptions:
    - policyName: require-resource-limits
      ruleNames:
        - require-limits
        - autogen-require-limits
    - policyName: disallow-automount-sa-token
      ruleNames:
        - validate-automount
        - autogen-validate-automount
    - policyName: require-probes
      ruleNames:
        - require-probes
  match:
    any:
      - resources:
          kinds:
            - Deployment
            - ReplicaSet
            - Pod
          namespaces:
            - netbird-operator
            - netbird
          names:
            - netbird-operator*
            - netbird-cluster-router*