ci(cluster-policies): flip .policyignore to an allowlist

[devantler]

🤖 Generated by the Daily AI Assistant

Why

Upstream kyverno/policies added a new top-level policy category, and because .policyignore was a blocklist, the nightly policy sync leaked its fixture file into a red sync PR (#2483 — naming + Kubescape gate failures). Every future upstream category addition would break the same way.

What

Flips .policyignore to an allowlist: ignore everything upstream, re-include only the three policies the platform actually vendors. Verified by replaying the sync filter's exact matching logic against the full upstream tree — exactly the 3 vendored files survive.

After this merges, the next nightly sync regenerates an empty diff and #2483 closes itself.

[coderabbitai]

📝 Walkthrough

Walkthrough

The .policyignore file was rewritten from a deny/allow mixed rule set to an allowlist approach. It now ignores all upstream content by default using a wildcard pattern and explicitly re-includes only three vendored policy YAML files across supported categories. The previous broad ignore patterns and exception entries were removed, reducing the file to header comments and the new allowlist rules.

Changes

Area	Change
.policyignore	Switched from blocklist to allowlist; added global ignore plus three explicit re-includes

Sequence Diagram(s)

No sequence diagram generated, as this change is a configuration-only update to ignore rules with no observable code flow.

Related Issues: No related issues found.

Related PRs: No related pull requests found.

Suggested labels: documentation, low-effort

Suggested reviewers: devantler

🐰
A wildcard sweeps the ignore list clean,
then three small files return to the scene,
allowlist reigns where blocklists once stood,
a tidier policy, understood!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: switching .policyignore to an allowlist for cluster policies.
Description check	✅ Passed	The description is directly related to the changeset and explains the allowlist .policyignore fix and its impact.

---

_{Comment @coderabbitai help to get the list of available commands.}

[botantler-1]

🎉 This PR is included in version 1.100.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀