Use OPA Gatekeeper with kube-system namespace exception

Package Owner Merge Request

NOTE: !722 (merged) contains changes that should be approved first since this change will include that one.

Package Changes

MR: https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/merge_requests/84

Release: https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/releases/3.5.1-bb.8

Additional Details

Removes kube-system from big bang exclusions. Instead defaults to a namespace exclusion in OPA's config.

• Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/issues/66
• Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/issues/82
• Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/issues/107

chart/templates/gatekeeper/values.yaml

@@ -17,18 +17,20 @@ networkPolicies:
   enabled: {{ .Values.networkPolicies.enabled }}
   controlPlaneCidr: {{ .Values.networkPolicies.controlPlaneCidr }}
 violations:  # Try to keep this in alpha order to make it easier to find keys
+
+  {{- if or .Values.istio.enabled .Values.addons.mattermost.enabled }}
   allowedDockerRegistries:
+    {{- if .Values.istio.enabled }}
     match:
       excludedNamespaces:
-       {{- if .Values.istio.enabled }}
         - istio-system # allows creation for loadbalancer pods for various ports and various vendor loadbalancers
-       {{- end }}
-        - kube-system # ignored as the kubernetes distro cannot be controlled
+    {{- end }}
     {{- if .Values.addons.mattermost.enabled }}
     parameters:
       exemptContainers:
         - init-check-database # mattermost needs postgres:13 image and cannot override the upstream
     {{- end }}
+  {{- end }}
 
   {{- if .Values.monitoring.enabled }}
   hostNetworking:
@@ -50,7 +52,6 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
   noPrivilegedContainers:
     match:
       excludedNamespaces:
-        - kube-system
         - logging # Fluentbit needs privileged to read and store the buffer for tailing logs from the nodes
   {{- end }}
 
@@ -58,7 +59,6 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
   restrictedTaint:
     match:
       excludedNamespaces:
-        - kube-system
         - monitoring # Prometheus Node Exporter needs to be able to run on all nodes, regardless of taint, to gather node metrics
   {{- end }}
 
@@ -69,6 +69,7 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
         - logging # FluentBit needs selinux option type spc_t
   {{- end }}
 
+  {{- if or .Values.fluentbit.enabled (or .Values.twistlock.enabled .Values.monitoring.enabled) }}
   volumeTypes:
     match:
       excludedNamespaces:
@@ -87,5 +88,5 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
         # https://github.com/prometheus-community/helm-charts/blob/main/charts/prometheus-node-exporter/templates/daemonset.yaml#L150
         - monitoring
        {{- end }}
-        - kube-system #local-path_local-path-provisioner helper-pod-create-pvc
+  {{- end }}
 {{- end -}}