mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-20 23:16:49 +00:00
Scooby HuskyandClaude Opus 4.6
b795f5aa8f
ArgoCD, NetBird operator, and Scylla Manager are upstream Helm charts that don't set resource limits, probes, drop-all capabilities, or disable SA token automount. These audit-mode policy violations inflated the cumulative Prometheus failure counter to ~3800. - argocd: exempt from require-resource-limits, require-probes - netbird-operator: exempt from require-resource-limits, disallow-automount-sa-token, require-probes - scylla-manager: exempt from require-drop-all-capabilities, disallow-automount-sa-token Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
28 lines
707 B
YAML
28 lines
707 B
YAML
# Scylla Manager and ScyllaDB upstream charts do not drop all
|
|
# capabilities and automount the SA token for cluster management.
|
|
apiVersion: kyverno.io/v2
|
|
kind: PolicyException
|
|
metadata:
|
|
name: scylla-exemption
|
|
namespace: kyverno
|
|
spec:
|
|
exceptions:
|
|
- policyName: require-drop-all-capabilities
|
|
ruleNames:
|
|
- require-drop-all
|
|
- autogen-require-drop-all
|
|
- policyName: disallow-automount-sa-token
|
|
ruleNames:
|
|
- validate-automount
|
|
- autogen-validate-automount
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Deployment
|
|
- StatefulSet
|
|
- ReplicaSet
|
|
- Pod
|
|
namespaces:
|
|
- scylla-manager
|