added exempted user to guardrails

Azure · Dec 8, 2023 · 0312703 · 0312703
1 parent c3d127a
commit 0312703
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 0 deletions.
diff --git a/pkg/operator/controllers/guardrails/policies/gktemplates-src/library/common.rego b/pkg/operator/controllers/guardrails/policies/gktemplates-src/library/common.rego
@@ -58,6 +58,7 @@ is_priv_namespace(ns) = true {
 
 exempted_user = {
   "system:kube-controller-manager",
+  "system:kube-scheduler",
   "system:admin" # comment out temporarily for testing in console
 }
 

diff --git a/pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-delete-pull-secret.yaml b/pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-delete-pull-secret.yaml
@@ -86,6 +86,7 @@ spec:
 
           exempted_user = {
             "system:kube-controller-manager",
+            "system:kube-scheduler",
             "system:admin" # comment out temporarily for testing in console
           }
 

diff --git a/pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-machine-config.yaml b/pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-machine-config.yaml
@@ -91,6 +91,7 @@ spec:
 
           exempted_user = {
             "system:kube-controller-manager",
+            "system:kube-scheduler",
             "system:admin" # comment out temporarily for testing in console
           }
 

diff --git a/...erator/controllers/guardrails/policies/gktemplates/aro-deny-master-toleration-taints.yaml b/...erator/controllers/guardrails/policies/gktemplates/aro-deny-master-toleration-taints.yaml
@@ -110,6 +110,7 @@ spec:
 
           exempted_user = {
             "system:kube-controller-manager",
+            "system:kube-scheduler",
             "system:admin" # comment out temporarily for testing in console
           }
 

diff --git a/pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-privileged-namespace.yaml b/pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-privileged-namespace.yaml
@@ -108,6 +108,7 @@ spec:
 
           exempted_user = {
             "system:kube-controller-manager",
+            "system:kube-scheduler",
             "system:admin" # comment out temporarily for testing in console
           }