# Scoped exception to the disallow-host-namespaces STIG policy (V-242386),
# narrowly for the netbird-egress DaemonSet only - not a namespace-wide
# exclusion like crowdsec's (see disallow-host-namespaces ClusterPolicy).
#
# Why hostNetwork is genuinely needed here: no node in this cluster has any
# route into the Netbird mesh CIDR (100.108.0.0/16) for pod-originated
# egress traffic - confirmed 2026-08-17 while debugging CrowdSec/CNPG
# backups reaching the VPS. The existing per-namespace "router" pods
# (NBRoutingPeer-based) are inbound-only and run fine in ordinary pod
# network namespaces. An EGRESS gateway is architecturally different: its
# wt0 interface must live in each node's real network namespace so the
# node's own kernel routing table can send matched pod traffic out through
# it directly - a pod-netns router would need SNAT/forwarding indirection
# on top, and per-pod route injection isn't possible without hostPID
# (also STIG-blocked) or a Cilium egress-gateway feature that doesn't
# actually solve this (it selects source IP for already-routable traffic,
# it doesn't create the missing route).
apiVersion: kyverno.io/v2
kind: PolicyException
metadata:
  name: netbird-egress-exemption
  namespace: kyverno
spec:
  exceptions:
    - policyName: disallow-host-namespaces
      ruleNames:
        - host-namespaces
        - autogen-host-namespaces
  match:
    any:
      - resources:
          kinds:
            - DaemonSet
            - Pod
          namespaces:
            - netbird
          names:
            - netbird-egress*