Lock Down the Label That Ignores the Gatekeeper-System Namespace

[maxsmythe]

kubebuilder does this by default, and we embraced it by adding a label to gatekeeper-system.

We shouldn't do this as there is no way to ACL labels, meaning anyone with the power to create/edit namespaces can exempt themselves from constraints.

Since gatekeeper already does not self-manage, we should remove this, though there is a bootstrapping problem once we start failing closed: If the admission controller auto-rejects when we launch a pod, how can we re-launch a pod if gatekeeper ever goes down.

It'd be good if we could ignore specific namespaces at the validatingwebhookconfiguration level, rather than relying on selectors which, as stated above, are insecure.

[ritazh]

+1

Just to clarify, kubebuilder enables this behavior in gatekeeper, but namespaceselector is a property of the admission webhook configuration:
https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector

So maybe we should open up an issue for https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/api/admissionregistration/v1/types.go#L260

[ritazh]

Another option is to configure gatekeeper to ignore certain namespaces e.g. kube-system at init time.

[maxsmythe]

Configuring the Gatekeeper source code won't help as it's the API server that controls what happens when the pod is down.

There is some interesting context surrounding this issue:

kubernetes/kubernetes#54522

https://docs.google.com/document/d/1pw6FyobY3pVxfWYwmAFuF5WJpvjfq-M3Ciz996kblVc/edit#heading=h.ukbesxe0yjd

[maxsmythe]

We could add a second validating webhook endpoint, v1/nslabels that looks for an "ignore me" label and only allows it for certain namespaces. This webhook would watch Namespaces only. This gets around the self-management-causes-hard-down problem because validating namespaces wont prevent Pod creation.

Open question: whether and how the list of ignorable namespaces could be configured:

1. Do not allow the list to be configured (hardcoded)
2. Provide the list of "ignorable" namespaces via flags (requires restart to make changes)
3. Make the list configurable on the config resource.