mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 05:26:49 +00:00
71 lines
2.1 KiB
YAML
71 lines
2.1 KiB
YAML
apiVersion: kyverno.io/v2
|
|
kind: PolicyException
|
|
metadata:
|
|
name: rancher-exemption
|
|
namespace: kyverno
|
|
spec:
|
|
exceptions:
|
|
- policyName: restrict-image-registries
|
|
ruleNames:
|
|
- validate-container-registries
|
|
- autogen-validate-container-registries
|
|
- autogen-cronjob-validate-container-registries
|
|
- policyName: require-drop-all-capabilities
|
|
ruleNames:
|
|
- require-drop-all
|
|
- autogen-require-drop-all
|
|
- autogen-cronjob-require-drop-all
|
|
- policyName: require-resource-limits
|
|
ruleNames:
|
|
- require-limits
|
|
- autogen-require-limits
|
|
- autogen-cronjob-require-limits
|
|
- policyName: disallow-automount-sa-token
|
|
ruleNames:
|
|
- validate-automount
|
|
- autogen-validate-automount
|
|
- autogen-cronjob-validate-automount
|
|
- policyName: require-app-label
|
|
ruleNames:
|
|
- require-app-label
|
|
- policyName: require-probes
|
|
ruleNames:
|
|
- require-probes
|
|
- policyName: disallow-latest-tag
|
|
ruleNames:
|
|
- disallow-latest
|
|
- autogen-disallow-latest
|
|
- autogen-cronjob-disallow-latest
|
|
- policyName: require-non-root
|
|
ruleNames:
|
|
- require-run-as-non-root
|
|
- autogen-require-run-as-non-root
|
|
- autogen-cronjob-require-run-as-non-root
|
|
- policyName: require-readonly-rootfs
|
|
ruleNames:
|
|
- require-ro-rootfs
|
|
- autogen-require-ro-rootfs
|
|
- autogen-cronjob-require-ro-rootfs
|
|
- policyName: disallow-default-namespace
|
|
ruleNames:
|
|
- validate-namespace
|
|
- autogen-validate-namespace
|
|
- autogen-cronjob-validate-namespace
|
|
match:
|
|
any:
|
|
- resources:
|
|
namespaces:
|
|
- cattle-system
|
|
- cattle-fleet-system
|
|
- cattle-fleet-local-system
|
|
- cattle-capi-system
|
|
- cattle-turtles-system
|
|
- cattle-ui-plugin-system
|
|
- cattle-impersonation-system
|
|
- cattle-global-data
|
|
- cattle-local-user-passwords
|
|
- cattle-fleet-clusters-system
|
|
- fleet-default
|
|
- fleet-local
|
|
- cluster-fleet-*
|