feat: add label-based exclusion to inject-coco-initdata policy

[butler54]

Problem

Kyverno's inject-coco-initdata policy currently has no exclusion mechanism. All kata pods must have the coco.io/initdata-configmap annotation, or the policy fails when trying to read the (non-existent) ConfigMap.

This blocks special-purpose kata pods that don't need init_data injection, such as:

• Firmware reference value collection pods (veritas-based measurement collection)
• Debug/troubleshooting pods
• One-off administrative tasks

Solution

Add an exclude block to the policy that skips pods with label coco.io/skip-initdata: "true".

exclude:
  any:
    - resources:
        selector:
          matchLabels:
            coco.io/skip-initdata: "true"

Changes

• charts/all/coco-kyverno-policies/templates/inject-coco-initdata.yaml: Add exclude block after match block

Usage

Special-purpose kata pods can bypass init_data injection by adding the label:

apiVersion: v1
kind: Pod
metadata:
  name: firmware-collector
  labels:
    coco.io/skip-initdata: "true"
spec:
  runtimeClassName: kata-cc
  # ... rest of spec

Benefits

• Self-documenting: Policy itself shows what gets excluded
• Type-safe: Uses label selectors instead of annotation value checks
• Explicit intent: Clear that bypass is intentional
• Reusable: Any pod can use this label

Related

• PR feat: add firmware reference values workflow for bare metal attestation #89: Firmware reference value collection workflow - primary use case for this exclusion
• Fixes error: mutation policy inject-coco-initdata error: failed to evaluate preconditions: failed to substitute variables in condition key

Testing

Deploy the updated policy, then launch a kata pod with coco.io/skip-initdata: "true" label:

• Verify policy does not attempt to inject init_data
• Verify pod launches successfully
• Verify normal kata pods (without the label) still get init_data injection

🤖 Generated with Claude Code