Moved the excluded namespaces to the new regex method for excluded resources.

Merge Request

No package changes. Scope is in Big Bang only.

Excluded namespaces converted to excluded resources where the exclusion could be narrowed down to namespace and pod/container name using regex.

Values added to k3d-dev-values.yaml and ci/k3d/values.yaml to accommodate load balancer pod/container exceptions.

Additional Details

For testing, all packages should be deployed and no denies should occur. Use kubectl get events -n <namespace> to check for denies.

closes #693 (closed)

closes #776 (closed)

chart/templates/gatekeeper/values.yaml

@@ -68,31 +68,31 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
 
   {{- if .Values.addons.mattermost.enabled }}
   httpsOnly:
-    match:
-      excludedNamespaces:
+    parameters:
+      excludedResources:
         # Mattermost currently does not useIngressTLS hence Ingress is created without TLS field by the operator.
         # Adding exemption, pending https://github.com/mattermost/mattermost-operator/issues/235
-        - mattermost
+        - mattermost/.*
   {{- end }}
 
   namespacesHaveIstio:
     enabled: {{ .Values.istio.enabled }}
 
   {{- if .Values.logging.enabled }}
-  noPrivilegedContainers:
-    match:
-      excludedNamespaces:
+  noPrivilegedContainers:    
+    parameters:
+      excludedResources:
         # Fluentbit needs privileged to read and store the buffer for tailing logs from the nodes
-        - logging
+        - logging/.*
   {{- end }}
 
   podsHaveIstio:
     enabled: {{ .Values.istio.enabled }}
-    match:
-      excludedNamespaces:
+    parameters:
+      excludedResources:
         # Istio does not inject sidecars in itself
-        - istio-operator
-        - istio-system
+        - istio-operator/.*
+        - istio-system/.*
 
   {{- if or .Values.monitoring.enabled .Values.twistlock.enabled }}
   restrictedTaint:
@@ -112,10 +112,10 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
   {{- if or .Values.logging.enabled .Values.twistlock.enabled }}
   selinuxPolicy:
     {{- if .Values.logging.enabled }}
-    match:
-      excludedNamespaces:
+    parameters:
+      excludedResources:
         # FluentBit needs selinux option type spc_t
-        - logging
+        - logging/.*
     {{- end }}
     {{- if .Values.twistlock.enabled }}
     parameters:
@@ -127,22 +127,22 @@ violations:  # Try to keep this in alpha order to make it easier to find keys
 
   {{- if or .Values.fluentbit.enabled (or .Values.twistlock.enabled .Values.monitoring.enabled) }}
   volumeTypes:
-    match:
-      excludedNamespaces:
+    parameters:
+      excludedResources:
        {{- if .Values.fluentbit.enabled }}
         # fluent-bit container requires certain host level access to ship logs and for keep track of state
         # https://docs.fluentbit.io/manual/pipeline/filters/kubernetes#workflow-of-tail-kubernetes-filter
-        - logging
+        - logging/.*
        {{- end }}
        {{- if .Values.twistlock.enabled }}
         # Twistlock requires /dev/log for its syslog daemon.
         # https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/audit/logging.html#
-        - twistlock
+        - twistlock/.*
        {{- end }}
        {{- if .Values.monitoring.enabled }}
         # Prometheus node exported requires hostpath hardcoded in upstream chart on which monitoring pkg has a direct dependency
         # https://github.com/prometheus-community/helm-charts/blob/main/charts/prometheus-node-exporter/templates/daemonset.yaml#L150
-        - monitoring
+        - monitoring/.*
        {{- end }}
   {{- end }}
 {{- end -}}