# Approved monitoring exceptions, reviewed 2026-09-24. No dependency/secret exclusions.
misconfigurations:
  - id: AVD-KSV-0047
    paths: [infra/prod/k8s/monitoring/03-prometheus.yaml]
    expired_at: 2026-10-24
    statement: Prometheus scrapes kubelet cAdvisor through the API server node proxy; retain until direct authenticated kubelet scraping is validated.
  - id: AVD-KSV-0009
    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
    expired_at: 2026-10-24
    statement: Node exporter observes host network metrics; isolated to the monitoring DaemonSet.
  - id: AVD-KSV-0010
    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
    expired_at: 2026-10-24
    statement: Node exporter observes host processes; runs as non-root with all capabilities dropped.
  - id: AVD-KSV-0024
    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
    expired_at: 2026-10-24
    statement: Existing host-network exporter listens on port 9101; access remains constrained by infrastructure firewall rules.
  - id: AVD-KSV-0121
    paths: [infra/prod/k8s/monitoring/04-node-exporter.yaml]
    expired_at: 2026-10-24
    statement: Host proc/sys/root mounts provide disk and system metrics and are read-only; required for disk-full alerts.