UNCLASSIFIED - NO CUI

gatekeeper deploy failure

Gatekeeper fails to deploy if mattermost is not enabled.

Helm release logs:

  Normal  error   36m (x4 over 55m)  helm-controller  Helm install failed: failed post-install: warning: Hook post-install gatekeeper/templates/constraints/httpsOnly.yaml failed: K8sHttpsOnly.constraints.gatekeeper.sh "https-only" is invalid: spec.match.excludedNamespaces: Invalid value: "null": spec.match.excludedNamespaces in body must be of type array: "null"

Helm release values with the corresponding error:

USER-SUPPLIED VALUES:
image:
  pullSecrets:
  - name: private-registry
networkPolicies:
  controlPlaneCidr: 0.0.0.0/0
  enabled: true
postInstall:
  labelNamespace:
    enabled: false
    image:
      pullSecrets:
      - name: private-registry
replicas: 1
resources:
  limits: {}
  requests:
    cpu: 100m
    memory: 256Mi
violations:
  allowedDockerRegistries:
    match:
      excludedNamespaces:
      - istio-system
      - kube-system
  httpsOnly:
    match:
      excludedNamespaces: null   # NOTE: this null should be a list according to the error
  noPrivilegedContainers:
    match:
      excludedNamespaces:
      - kube-system
      - logging
  selinuxPolicy:
    match:
      excludedNamespaces:
      - logging
  volumeTypes:
    match:
      excludedNamespaces:
      - logging
      - kube-system

This appears to be the underlying cause: https://repo1.dso.mil/platform-one/big-bang/bigbang/-/blame/master/chart/templates/gatekeeper/values.yaml#L40-47

Resolved in !714 (merged).