Kyverno policy exception

helm/1password-scim-bridge/templates/_helpers.tpl

@@ -35,3 +35,17 @@ giantswarm.io/managed-by: {{ .Release.Name | quote }}
 giantswarm.io/service-type: {{ .Values.serviceType }}
 helm.sh/chart: {{ include "chart" . | quote }}
 {{- end -}}
+
+{{/*
+Name used by Giant Swarm-specific helpers for this App.
+*/}}
+{{- define "onepassword-scim-bridge-helpers.name" -}}
+{{ include "name" . | quote }}
+{{- end -}}
+
+{{/*
+Labels used by Giant Swarm-specific helpers for this App.
+*/}}
+{{- define "onepassword-scim-bridge-helpers.labels" -}}
+{{ include "labels.common" . }}
+{{- end -}}

helm/1password-scim-bridge/templates/kyverno-policy-exception.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.kyvernoPolicyExceptions.enabled }}
+{{- if .Capabilities.APIVersions.Has "kyverno.io/v2/PolicyException" }}
+apiVersion: kyverno.io/v2
+{{- else}}
+apiVersion: kyverno.io/v2beta1
+{{- end }}
+kind: PolicyException
+metadata:
+  name: {{ include "onepassword-scim-bridge-helpers.name" . }}-exception
+  namespace: {{ .Values.kyvernoPolicyExceptions.namespace | default .Release.Namespace }}
+  annotations:
+    "helm.sh/hook": "pre-install,pre-upgrade"
+  labels:
+    {{ include "onepassword-scim-bridge-helpers.labels" . | nindent 4 }}
+spec:
+  exceptions:
+    - policyName: require-run-as-nonroot
+      ruleNames:
+        - autogen-run-as-non-root
+        - run-as-non-root
+  match:
+    any:
+      - resources:
+          kinds:
+            - Deployment
+            - ReplicaSet
+            - Pod
+          namespaces:
+            - {{ .Release.Namespace }}
+          names:
+            - "onepassword-scim-bridge*"
+---
+{{- end }}