How to exempt pods with specific labels from Azure policy in Azure kubernetes Service?

Tanul 1,246 Reputation points
2021-05-08T20:18:02.687+00:00

Team,

I have situation where I need to exempt the policies while creation of pods if a specific label is assigned to it.

I'm applying container no privilege policy on the cluster i.e. Kubernetes cluster should not allow privileged containers.

Can anyone suggest the procedure to exempt the labels. I tried this one but getting syntax error.

Please help. Thank you.

![95022-image.png

Azure Kubernetes Service (AKS)
Azure Kubernetes Service (AKS)
An Azure service that provides serverless Kubernetes, an integrated continuous integration and continuous delivery experience, and enterprise-grade security and governance.
1,787 questions
{count} votes

1 answer

Sort by: Most helpful
  1. shiva patpi 12,961 Reputation points Microsoft Employee
    2021-05-11T03:45:30.863+00:00

    Hello @Tanul ,
    Thanks for your query !
    I just tried out below syntax and it works , can you also try out from your end.
    Kindly adjust the values accordingly.

    95340-image.png

    {
    "matchLabels":{"app":"nginx"},
    "matchExpressions":
    [
    {"key": "test", "operator": "NotIn", "values": ["1"]}
    ]

    }

    Explanation:-
    Based upon the Schema:
    matchLabels is of type Json Object
    Match Expression is an Array of values

    Let us know if the above helps out !
    Make sure to "Upvote & Accept the answer"

    1 person found this answer helpful.