Gatekeeper - add fine-grained exclusion for resources

Package Owner Merge Request

Package Changes

• https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/merge_requests/87

• https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/merge_requests/93

• https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/releases/3.5.1-bb.14

• https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/releases/3.5.1-bb.15

• https://repo1.dso.mil/platform-one/big-bang/apps/core/cluster-auditor/-/merge_requests/53

• https://repo1.dso.mil/platform-one/big-bang/apps/core/cluster-auditor/-/merge_requests/54

• https://repo1.dso.mil/platform-one/big-bang/apps/core/cluster-auditor/-/releases/0.3.0-bb.5

Additional Details

Adds ability to exclude resources using regex matches for namespace/resource_name in violations.<constraintname>.properties.excludedResources values.

NOTE: We haven't updated any values in big bang chart/templates/gatekeeper/values.yaml yet. The old exclusions will still work for now.

Closes https://repo1.dso.mil/platform-one/big-bang/apps/core/policy/-/issues/103

label ~opagatekeeper

chart/dev-k3d-values.yaml

@@ -7,5 +7,11 @@ gatekeeper:
     violations:
       allowedDockerRegistries:
         match:
-          excludedNamespaces: 
-            - istio-system 
\ No newline at end of file
+          excludedNamespaces:
+          # Allows load balancer images for k3d from public repo
+          - istio-system
+      hostNetworking:
+        match:
+          excludedNamespaces:
+          # Allows load balancer containers to map ports for k3d
+          - istio-system
\ No newline at end of file