chore: bump opa and remove kube-system ref

chart/templates/gatekeeper/values.yaml

@@ -12,23 +12,25 @@ postInstall:
     image:
       pullSecrets:
       - name: private-registry
-      
+
 networkPolicies:
   enabled: {{ .Values.networkPolicies.enabled }}
   controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
 violations:  # Try to keep this in alpha order to make it easier to find keys
+
+  {{- if or .Values.istio.enabled .Values.addons.mattermost.enabled }}
   allowedDockerRegistries:
+    {{- if .Values.istio.enabled }}
     match:
-      excludedNamespaces: 
-       {{- if .Values.istio.enabled }}
+      excludedNamespaces:
         - istio-system # allows creation for loadbalancer pods for various ports and various vendor loadbalancers
-       {{- end }}
-        - kube-system # ignored as the kubernetes distro cannot be controlled
+    {{- end }}
     {{- if .Values.addons.mattermost.enabled }}
     parameters:
       exemptContainers:
         - init-check-database # mattermost needs postgres:13 image and cannot override the upstream
     {{- end }}
+  {{- end }}
 
   {{- if .Values.monitoring.enabled }}
   hostNetworking:
@@ -40,7 +42,7 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
   {{- if .Values.addons.mattermost.enabled }}
   httpsOnly:
     match:
-      excludedNamespaces: 
+      excludedNamespaces:
         # mattermost currently does not useIngressTLS hence Ingress is created without TLS field by the operator.
         # Adding exemption, pending https://github.com/mattermost/mattermost-operator/issues/235
         - mattermost
@@ -50,7 +52,6 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
   noPrivilegedContainers:
     match:
       excludedNamespaces:
-        - kube-system
         - logging # Fluentbit needs privileged to read and store the buffer for tailing logs from the nodes
   {{- end }}
 
@@ -58,7 +59,6 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
   restrictedTaint:
     match:
       excludedNamespaces:
-        - kube-system
         - monitoring # Prometheus Node Exporter needs to be able to run on all nodes, regardless of taint, to gather node metrics
   {{- end }}
 
@@ -69,16 +69,17 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
         - logging # FluentBit needs selinux option type spc_t
   {{- end }}
 
+  {{- if or .Values.fluentbit.enabled (or .Values.twistlock.enabled .Values.monitoring.enabled) -}}
   volumeTypes:
     match:
-      excludedNamespaces: 
+      excludedNamespaces:
        {{- if .Values.fluentbit.enabled }}
         # fluent-bit container requires certain host level access to ship logs and for keep track of state
         # https://docs.fluentbit.io/manual/pipeline/filters/kubernetes#workflow-of-tail-kubernetes-filter
         - logging
        {{- end }}
        {{- if .Values.twistlock.enabled }}
-        # Twistlock requires /dev/log for its syslog daemon. 
+        # Twistlock requires /dev/log for its syslog daemon.
         # https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/audit/logging.html#
         - twistlock
        {{- end }}
@@ -87,5 +88,5 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
         # https://github.com/prometheus-community/helm-charts/blob/main/charts/prometheus-node-exporter/templates/daemonset.yaml#L150
         - monitoring
        {{- end }}
-        - kube-system #local-path_local-path-provisioner helper-pod-create-pvc
+  {{- end }}
 {{- end -}}

chart/values.yaml

@@ -281,7 +281,7 @@ gatekeeper:
   git:
     repo: https://repo1.dso.mil/platform-one/big-bang/apps/core/policy.git
     path: "./chart"
-    tag: "3.5.1-bb.4"
+    tag: "3.5.1-bb.8"
 
   # -- Flux reconciliation overrides specifically for the OPA Gatekeeper Package
   flux: