By default turn off image digest constraint in gatekeeper
In Big Bang, we use the tag for pulling images because Iron Bank rebuilds images every 12 hours with base image updates (e.g. STIG changes, library updates). Using digests is not feasible at this time unless automation can be put in place to update the digests for packages.
OPA Gatekeeper has a constraint to check for images pulled without digests. This is on by default. Since every image would be flagged, resulting in log noise, Big Bang should disable this constraint in its default settings.
Update chart/templates/gatekeeper/values.yaml to turn off this constraint and validate the violations are no longer flagged.
Edited by Michael McLeroy