Feature Request: annotating rule for namespaces/excludedNamespaces

[dulltz]

Like #93, I'd like to support annotating rules that generate spec.match.namespaces and spec.match.excludedNamespaces.

Examples

# @namespaces kube-system gatekeeper-system
package foo

import data.lib.core
...

↓

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: Foo
metadata:
  name: foo
spec:
  match:
    namespaces:
      - kube-system
      - gatekeeper-system

---

# @ excludednamespaces kube-system gatekeeper-system
package foo

import data.lib.core
...

↓

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: Foo
metadata:
  name: foo
spec:
  match:
    excludedNamespaces:
      - kube-system
      - gatekeeper-system

[jalseth]

Hi @dulltz, sorry for the delay in response. Looking back, I think I may have moved too quickly when moving forward with #93 as it somewhat goes against Konstraint's original goal of enabling the same policies to be used with Conftest and then deployed in the cluster with Gatekeeper, since these @ tags add the matching metadata to the Gatekeeper resources, but won't have any effect when using Conftest.

I understand that some people may not use Conftest, and may instead test with gvk or similar tools so I'm hoping to find a middle ground. What are your thoughts on adding a lib.matching Rego lib with helpers that would accomplish the same matching that we're adding here, but using Rego rather than the Gatekeeper CRDs to match? This way, there is feature parity either way people decide to use the tool.

[dulltz]

I totally agree with @jalseth 's opinion.

Since users who use the Gatekeeper match field will have to manually edit the generated custom resource,
we should focus on the #56 issue.

[jalseth]

In that case, adding a @skip-constraint option in the Rego header may be the best way forward. That way if users want to manually manage the Constraints for a given policy and set matchers, parameters, etc. they can. If that approach is agreeable I can add that in the next couple of days.

[jalseth]

@dulltz The tag was added in #130 and will be included in the next release.

[jpreese]

@skip-constraint released in v0.12.0