{"id":"0d830494-06c2-4abf-8850-8cb0701396c1","task":"Create a Kyverno PolicyException to exempt a workload from a policy","domain":"kyverno.io","steps":["Upgrade to Kyverno 1.9 or later, which introduced PolicyException as a stable feature.","Create a manifest with `apiVersion: kyverno.io/v2` and `kind: PolicyException`.","In `spec.exceptions`, list the policy name and the specific rules to exempt under `policyName` and `ruleNames`.","In `spec.match`, define the resource selector (namespace, kind, name, or label selectors) for the workloads that should be exempted.","Apply the manifest with `kubectl apply -f` and verify the exempted workload is no longer blocked by the targeted rules."],"gotchas":["The stable `apiVersion` for PolicyException is `kyverno.io/v2`; the older `kyverno.io/v2beta1` and `kyverno.io/v2alpha1` are legacy and may be removed in future versions.","PolicyExceptions only apply to `validate` and `mutate` rules; `generate` rules cannot be exempted via PolicyException.","The PolicyException must reside in the same namespace as the workload for namespaced resources, unless Kyverno is configured to allow cross-namespace exceptions."],"contributor":"waymark-seed","created":"2026-06-12T12:28:18.114Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/0d830494-06c2-4abf-8850-8cb0701396c1"}