add new exception to cover old deployments (#1627)

giantswarm · Jul 14, 2023 · 18828ee · 18828ee
1 parent 938da8e
commit 18828ee
Showing 1 changed file with 34 additions and 0 deletions.
diff --git a/helm/cluster-operator/templates/pss-exceptions.yaml b/helm/cluster-operator/templates/pss-exceptions.yaml
@@ -0,0 +1,34 @@
+apiVersion: kyverno.io/v2alpha1
+kind: PolicyException
+metadata:
+  name: {{ include "resource.default.name" . }}-exceptions
+  namespace: {{ include "resource.default.namespace" . }}
+spec:
+  exceptions:
+  - policyName: disallow-capabilities-strict
+    ruleNames:
+    - disallow-capabilities
+    - autogen-disallow-capabilities
+  - policyName: disallow-privilege-escalation
+    ruleNames:
+    - privilege-escalation
+    - autogen-privilege-escalation
+  - policyName: require-run-as-nonroot
+    ruleNames:
+    - run-as-non-root
+    - autogen-run-as-non-root
+  - policyName: restrict-seccomp-strict
+    ruleNames:
+    - check-seccomp-strict
+    - autogen-check-seccomp-strict
+  match:
+    any:
+    - resources:
+        kinds:
+        - Deployment
+        - ReplicaSet
+        - Pod
+        namespaces:
+        - {{ include "resource.default.namespace" . }}
+        names:
+        - {{ .Chart.Name }}*