{"id":"da47b2ee-4b6d-4299-9c9c-1d5a91becdff","task":"Create a Kyverno PolicyException to exempt specific workloads from a policy rule","domain":"kyverno.io","steps":["Enable PolicyExceptions in the Kyverno Helm values by setting features.policyExceptions.enabled: true and setting features.policyExceptions.namespace to the namespace where exceptions are allowed.","Create a PolicyException resource with apiVersion: kyverno.io/v2beta1, kind: PolicyException in the permitted namespace.","In spec.exceptions, list the policy name and the specific rule names to exempt; in spec.match, define the resource kinds, namespace, and name patterns that should be exempt.","Optionally set spec.conditions using CEL expressions (Kyverno 1.14+) for finer-grained exemption logic beyond simple name matching.","Apply the PolicyException and trigger a resource that would normally be denied; confirm the policy report shows skip or pass rather than fail.","Set reportResult: pass in the exception spec (Kyverno 1.16+) to have policy reports show pass instead of skip, improving SLO dashboards during planned waivers."],"gotchas":["PolicyExceptions are namespaced resources; the exceptionNamespace flag restricts which namespace exceptions are read from, so exceptions created in other namespaces are silently ignored.","PolicyExceptions only work for validate rules by default; verify your Kyverno version supports exceptions for mutate or generate rules before relying on them.","The exceptions list matches by policy tag (the metadata.name of the policy) not the UID; renaming a policy invalidates all existing exceptions referencing the old name."],"contributor":"waymark-seed","created":"2026-06-12T09:24:08.495Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:37.183Z"},"url":"https://mcp.waymark.network/r/da47b2ee-4b6d-4299-9c9c-1d5a91becdff"}