fix: exclude gs namespace in matchExpressions

[ritazh]

Signed-off-by: Rita Zhang [email protected]

What this PR does / why we need it:
Exclude gatekeeper-system namespace as part of matchExpressions in the webhook configs

Which issue(s) this PR fixes (optional, using fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when the PR gets merged):
Fixes #

Special notes for your reviewer:

[codecov-commenter]

Codecov Report

Base: 53.47% // Head: 53.57% // Increases project coverage by +0.10% 🎉

Coverage data is based on head (bd5d6b2) compared to base (494ff64).
Patch has no changes to coverable lines.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2385      +/-   ##
==========================================
+ Coverage   53.47%   53.57%   +0.10%     
==========================================
  Files         117      117              
  Lines       10230    10281      +51     
==========================================
+ Hits         5470     5508      +38     
- Misses       4338     4350      +12     
- Partials      422      423       +1     

Flag	Coverage Δ
unittests	53.57% <ø> (+0.10%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/gator/test/types.go	61.53% <0.00%> (-26.93%)	⬇️
pkg/gator/runner.go	85.54% <0.00%> (-3.39%)	⬇️
pkg/webhook/policy.go	40.13% <0.00%> (-0.37%)	⬇️
pkg/gator/result.go	72.72% <0.00%> (ø)
pkg/webhook/stats_reporter.go	90.38% <0.00%> (+0.38%)	⬆️
...onstrainttemplate/constrainttemplate_controller.go	56.22% <0.00%> (+2.15%)	⬆️
pkg/gator/printer_go.go	46.78% <0.00%> (+2.34%)	⬆️
pkg/webhook/common.go	65.21% <0.00%> (+5.89%)	⬆️
pkg/gator/test/test.go	61.90% <0.00%> (+6.66%)	⬆️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[maxsmythe]

Is this not covered by the admission.gatekeeper.sh/ignore label?

[acpana]

for my own learning, what is the context/ issue here? That g8r can start reporting/ enforcing violations against itself?

for history, has this always been a concern?

do we always want to exclude the gatekeeper namespace? could this action be done in code (maybe even as a config option) instead?

[sozercan]

@maxsmythe i think the context here is the deletion of gatekeeper-system namespace itself. If there's an addon manager reconcile on gatekeeper but namespace itself is deleted, then GK pods will never come up as namespace will not have the label. It's an edge case but possible.

[sozercan]

@acpana yes, GK namespace itself is excluded to avoid circular dependency. We added the /admitlabel endpoint and admission.gatekeeper.sh/ignore label to bypass in the webhook level. Otherwise, we have the config namespace exclusion to exclude namespaces in the GK level. https://open-policy-agent.github.io/gatekeeper/website/docs/exempt-namespaces#difference-between-exclusion-using-config-resource-and---exempt-namespace-flag

[maxsmythe]

@sozercan makes sense, thanks!

[sozercan]

LGTM

[maxsmythe]

LGTM