document default namespace policy scope

2026-08-10 18:02:40 -04:00
parent e389331a07
commit f183d7f8dc
2 changed files with 10 additions and 0 deletions
@@ -8,6 +8,9 @@ metadata:
    policies.kyverno.io/severity: medium
    # Supplemental namespace-isolation control. This is not a one-to-one CIS control.
    policies.kyverno.io/cis-control: "supplemental"
+    # ConfigMaps and Secrets are intentionally excluded. They are supporting
+    # data rather than application entrypoints, and matching Secrets would also
+    # require broader Kyverno reports-controller read permissions.
 spec:
  validationFailureAction: Enforce
  background: false