Cleaner solution for customer overrides to gatekeeper exceptions
New issue as identified in https://repo1.dso.mil/platform-one/big-bang/bigbang/-/merge_requests/768#note_385861
Investigate and implement a new solution for easier customer overrides to the gatekeeper exceptions. Currently if a customer overrides an exception they will have to provide all of the BB exceptions in addition to whatever they want to add. An ideal solution would allow a customer to provide their overrides and have the BigBang overrides be merged/appended automagically.
One example of a possible solution to this identified in the aforementioned comment:
- Values file
gatekeeper:
exceptions:
allowedHostFilesystem:
- namespace1
- chart/templates/gatekeeper/values.yaml
allowedHostFilesystem:
match:
excludedNamespaces:
# required for monitoring's prometheus-node-exporter to get node metrics
excludedNamespaces:
# Prometheus-node-exporter needs access to host to get node metrics
{{- if .Values.monitoring.enabled }}
- monitoring
{{- end }}
# Some sort of range or if/with function, just an example
{{- dig "allowedHostFilesystem" list $values .Values.gatekeeper.exceptions }}
{{- range ... }}
- {{ $x }}
{{- end }}
Edited by Micah Nagel