UNCLASSIFIED - NO CUI

Cleaner solution for customer overrides to gatekeeper exceptions

New issue as identified in https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/768#note_385861

Investigate and implement a new solution for easier customer overrides to the gatekeeper exceptions. Currently if a customer overrides an exception they will have to provide all of the BB exceptions in addition to whatever they want to add. An ideal solution would allow a customer to provide their overrides and have the BigBang overrides be merged/appended automagically.

One example of a possible solution to this identified in the aforementioned comment:

  • Values file
gatekeeper:
  exceptions:
    allowedHostFilesystem:
      - namespace1
  • chart/templates/gatekeeper/values.yaml
  allowedHostFilesystem:
    match:
      excludedNamespaces: 
        # required for monitoring's prometheus-node-exporter to get node metrics
      excludedNamespaces:
        # Prometheus-node-exporter needs access to host to get node metrics
        {{- if .Values.monitoring.enabled }}
        - monitoring
        {{- end }}
        # Some sort of range or if/with function, just an example
        {{- dig "allowedHostFilesystem" list $values .Values.gatekeeper.exceptions }}
        {{- range ... }}
        - {{ $x }}
        {{- end }}
Edited by Micah Nagel