PolicyExceptions: KCA practice questions

A PolicyException lets chosen resources bypass chosen rules without editing the policy itself. In the legacy kyverno.io API, version v2, the spec has an exceptions list, where each entry names a policyName and the ruleNames it covers, and a match block, in the familiar match and exclude format, describing which resources are exempt. An optional conditions block refines the selection with expressions in the style of preconditions, so an exemption can depend on the content of a resource rather than only its kind, namespace and name.

Exceptions are disabled by default. They are enabled with the enablePolicyException container flag, default false, on the admission, background and reports controllers, and the exceptionNamespace flag names the namespace where PolicyExceptions are permitted; it is required once the feature is enabled. A PolicyException is a namespaced object, but its own namespace has no relationship to the namespaces of the resources it exempts, and it can exempt cluster-scoped resources too. When a ClusterPolicy and a namespaced Policy share a name, policyName takes the form namespace/name for the namespaced one.

Names must line up. ruleNames accepts wildcards. Rules created by auto-generation for Pod controllers must be listed along with the original rule, because an exemption for a Deployment does not cover the rules Kyverno generated for it, and since those generated names can include hashes, a wildcard is often needed. Exceptions also may not match on the same fields that validate rules forbid. In reports, a resource covered by an exception shows skip instead of fail, and background scanning respects exceptions as well.

The legacy resource includes a podSecurity block for exempting specific Pod Security Standards controls, optionally only for certain images or field values. The whole kyverno.io PolicyException is deprecated as of Kyverno 1.19 and scheduled for removal in 1.20 together with ClusterPolicy. Its replacement lives in policies.kyverno.io and works with the CEL-based policy types: it references policies through policyRefs with a name and kind, selects requests with CEL matchConditions, can list images and allowedValues that the policy reads as exceptions.allowedImages and exceptions.allowedValues, and can set reportResult to pass instead of the default skip. It applies in both admission and background modes.

Exceptions are not the only way to carve out scope, and they are not always the right one. When a policy should never apply to some resources, such as a system namespace, an exclude block in the policy expresses that directly and is visible to anyone reading it. Kyverno's own configuration already keeps the kube-system and kyverno namespaces out of its webhooks by default. Exceptions are for the cases where the policy is right in general and a specific, named workload needs to differ, and policies can also be written with exceptions inside their rules.