fix(clustertool): exclude cnpg pods from kyverno

truecharts · Oct 24, 2024 · d9ff599 · d9ff599
1 parent 9dd13f9
commit d9ff599
Showing 1 changed file with 8 additions and 0 deletions.
diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
@@ -23,6 +23,12 @@ spec:
       - resources:
           kinds:
           - Pod
+    exclude:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              name: '*cnpg*'
     preconditions:
       all:
       - key: "{{request.operation || 'BACKGROUND'}}"
@@ -31,6 +37,8 @@ spec:
     mutate:
       foreach:
       - list: "request.object.spec.containers"
+        # Exclude containers with 'cloudnative-pg' in the name
+        filter: "element.name != 'cloudnative-pg'"
         context:
           - name: resolvedRef
             imageRegistry: