fix kyverno policy and ref name (#19)

caas-team · Dec 9, 2024 · d08291c · d08291c
1 parent 2b30b40
commit d08291c
Showing 1 changed file with 14 additions and 3 deletions.
diff --git a/chart/templates/policyexception.yaml b/chart/templates/policyexception.yaml
@@ -2,6 +2,8 @@
 apiVersion: kyverno.io/v2
 kind: PolicyException
 metadata:
+  annotations:
+    "helm.sh/hook": pre-install
   name: kepler-{{ include "caas-carbon-footprint.fullname" . }}
   labels:
     app.kubernetes.io/component: kepler
@@ -14,39 +16,49 @@ spec:
   - policyName: disallow-host-namespaces
     ruleNames:
     - autogen-host-namespaces
+    - host-namespaces
   - policyName: disallow-host-path
     ruleNames:
     - autogen-host-path
+    - host-path
   - policyName: disallow-host-ports
     ruleNames:
     - autogen-host-ports-none
+    - host-ports-none
   - policyName: disallow-privilege-escalation
     ruleNames:
     - autogen-privilege-escalation
+    - privilege-escalation
   - policyName: disallow-privileged-containers
     ruleNames:
     - autogen-privileged-containers
+    - privileged-containers
   - policyName: drop-all-capabilities
     ruleNames:
     - autogen-require-drop-all
     - autogen-validate-readOnlyRootFilesystem
+    - require-drop-all
+    - validate-readOnlyRootFilesystem
   - policyName: require-run-as-nonroot
     ruleNames:
     - autogen-run-as-non-root
+    - run-as-non-root
   - policyName: restrict-controlplane-scheduling
     ruleNames:
     - autogen-restrict-controlplane-scheduling-control-plane
+    - restrict-controlplane-scheduling-control-plane
   - policyName: require-ro-rootfs
     ruleNames:
     - autogen-validate-readOnlyRootFilesystem
+    - validate-readOnlyRootFilesystem
   match:
     any:
     - resources:
         kinds:
         - Pod
         - DaemonSet
         names:
-        - {{ include "caas-carbon-footprint.fullname" . }}*
+        - {{ .Release.Name }}*
         namespaces:
         - {{ .Release.Namespace }}
 {{- end }}
@@ -62,7 +74,6 @@ metadata:
   {{- if .Values.kyverno.namespace }}
   namespace: {{ .Values.kyverno.namespace }}
   {{- end }}
-
 spec:
   exceptions:
   - policyName: restrict-clusterrole-nodesproxy
@@ -71,5 +82,5 @@ spec:
   match:
     any:
     - clusterRoles:
-      - {{ include "caas-carbon-footprint.fullname" . }}-kepler-clusterrole
+      - {{ .Release.Name }}-kepler-clusterrole
 {{- end }}