mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Opus 4.6
b795f5aa8f
ArgoCD, NetBird operator, and Scylla Manager are upstream Helm charts that don't set resource limits, probes, drop-all capabilities, or disable SA token automount. These audit-mode policy violations inflated the cumulative Prometheus failure counter to ~3800. - argocd: exempt from require-resource-limits, require-probes - netbird-operator: exempt from require-resource-limits, disallow-automount-sa-token, require-probes - scylla-manager: exempt from require-drop-all-capabilities, disallow-automount-sa-token Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
28 lines
684 B
YAML
28 lines
684 B
YAML
# ArgoCD upstream Helm chart does not set resource limits or probes on
|
|
# several components. These are audit-mode policies and ArgoCD is a
|
|
# third-party chart we don't control.
|
|
apiVersion: kyverno.io/v2
|
|
kind: PolicyException
|
|
metadata:
|
|
name: argocd-exemption
|
|
namespace: kyverno
|
|
spec:
|
|
exceptions:
|
|
- policyName: require-resource-limits
|
|
ruleNames:
|
|
- require-limits
|
|
- autogen-require-limits
|
|
- policyName: require-probes
|
|
ruleNames:
|
|
- require-probes
|
|
match:
|
|
any:
|
|
- resources:
|
|
kinds:
|
|
- Deployment
|
|
- StatefulSet
|
|
- ReplicaSet
|
|
- Pod
|
|
namespaces:
|
|
- argocd
|