config:
  # resource types to be skipped by kyverno policy engine
  # Make sure to surround each entry in quotes so that it doesn't get parsed
  # as a nested YAML list. These are joined together without spaces in the configmap
  resourceFilters:
  - "[Event,*,*]"
  - "[*,kube-system,*]"
  - "[*,kube-public,*]"
  - "[*,kube-node-lease,*]"
  - "[Node,*,*]"
  - "[APIService,*,*]"
  - "[TokenReview,*,*]"
  - "[SubjectAccessReview,*,*]"
  - "[SelfSubjectAccessReview,*,*]"
  - "[*,kyverno,*]"
  - "[Binding,*,*]"
  - "[ReplicaSet,*,*]"
  - "[ReportChangeRequest,*,*]"
  - "[ClusterReportChangeRequest,*,*]"
  # Ignore some cert-manager E2E test components that can't easily be configured
  # to meet the pod security policy.
  - "[*,bind,*]"
  - "[*,ingress-nginx,*]"
  - "[*,sample-external-issuer-system,*]"
  # The Vault issuer E2E tests deploy Vault into each test namespace but it is
  # difficult to get it running non-root.
  # See https://github.com/jetstack/cert-manager/pull/4044
  - "[*,e2e-tests-*,*]"

config:
  # resource types to be skipped by kyverno policy engine
  # Make sure to surround each entry in quotes so that it doesn't get parsed
  # as a nested YAML list. These are joined together without spaces in the configmap
  resourceFilters:
  - "[Event,*,*]"
  - "[*,kube-system,*]"
  - "[*,kube-public,*]"
  - "[*,kube-node-lease,*]"
  - "[Node,*,*]"
  - "[APIService,*,*]"
  - "[TokenReview,*,*]"
  - "[SubjectAccessReview,*,*]"
  - "[SelfSubjectAccessReview,*,*]"
  - "[*,kyverno,*]"
  - "[Binding,*,*]"
  - "[ReplicaSet,*,*]"
  - "[ReportChangeRequest,*,*]"
  - "[ClusterReportChangeRequest,*,*]"
  # Ignore some cert-manager E2E test components that can't easily be configured
  # to meet the pod security policy.
  #
  # It's difficult to make Bind run non-root.
  # See https://github.com/sameersbn/docker-bind/issues/111
  - "[*,bind,*]"
  # It isn't possible to configure ingress-nginx for non-root operation.
  # See https://github.com/helm/charts/issues/14605
  - "[*,ingress-nginx,*]"
  # See https://github.com/cert-manager/sample-external-issuer/issues/18
  - "[*,sample-external-issuer-system,*]"
  # The Vault issuer E2E tests deploy Vault into each test namespace but it is
  # difficult to get it running non-root.
  # See https://github.com/jetstack/cert-manager/pull/4044
  - "[*,e2e-tests-*,*]"

Add comments explaining why we configure Kyverno to ignore certain E2E test namespaces
Add comments explaining why we configure Kyverno to ignore certain E2E test namespaces

Signed-off-by: Richard Wall <c2866c0eefadc742fd429365a658dfba4f801ca3@jetstack.io>
