apiVersion: kyverno.io/v2beta1
kind: PolicyException
metadata:
  name: system-cnoe-operation
  namespace: kyverno
spec:
  exceptions:
  - policyName: disallow-host-path
    ruleNames:
    - host-path
    - autogen-host-path
  - policyName: disallow-privilege-escalation
    ruleNames:
    - privilege-escalation
    - autogen-privilege-escalation
  - policyName: disallow-privileged-containers
    ruleNames:
    - privileged-containers
    - autogen-privileged-containers
  - policyName: disallow-capabilities-strict
    ruleNames:
    - require-drop-all
    - autogen-require-drop-all
    - adding-capabilities-strict
    - autogen-adding-capabilities-strict
    - adding-capabilities
    - autogen-adding-capabilities
  - policyName: disallow-capabilities
    ruleNames:
    - adding-capabilities
    - autogen-adding-capabilities
  - policyName: require-run-as-nonroot
    ruleNames:
    - run-as-non-root
    - autogen-run-as-non-root
  - policyName: restrict-seccomp-strict
    ruleNames:
    - check-seccomp-strict
    - autogen-check-seccomp-strict
  - policyName: restrict-volume-types
    ruleNames:
    - restricted-volumes
    - autogen-restricted-volumes
  - policyName: disallow-host-namespaces
    ruleNames:
    - host-namespaces
    - autogen-host-namespaces
  match:
    any:
    - resources:
        kinds:
        - Pod
        - Deployment
        - ReplicaSet
        - StatefulSet
        - DaemonSet
        namespaces:
        - kube-system
        - local-path-storage
        names:
        # TODO: this should be more targeted than blanket *
        - kube-*
        - kindnet*
        - local-path*
        - coredns*
        - etcd-*
