From d9ff599b26055838fbee874c60ef63d8f4d830cc Mon Sep 17 00:00:00 2001
From: Kjeld Schouten <info@kjeldschouten.nl>
Date: Thu, 24 Oct 2024 18:25:49 +0200
Subject: [PATCH] fix(clustertool): exclude cnpg pods from kyverno

---
 .../core/kyverno-policies/app/ensure-digest.yaml          | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
index 6c0b374d70f..1987796e4ba 100644
--- a/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
+++ b/clustertool/embed/generic/kubernetes/core/kyverno-policies/app/ensure-digest.yaml
@@ -23,6 +23,12 @@ spec:
       - resources:
           kinds:
           - Pod
+    exclude:
+        any:
+          - resources:
+              kinds:
+                - Pod
+              name: '*cnpg*'
     preconditions:
       all:
       - key: "{{request.operation || 'BACKGROUND'}}"
@@ -31,6 +37,8 @@ spec:
     mutate:
       foreach:
       - list: "request.object.spec.containers"
+        # Exclude containers with 'cloudnative-pg' in the name
+        filter: "element.name != 'cloudnative-pg'"
         context:
           - name: resolvedRef
             imageRegistry: