Add excludedNamespaces match type

[jeffa5]

This adds excludedNamespaces to the MatchSchema and provides the logic for checking it.

If there is anything that needs to be added or changed let me know :)

[jeffa5]

Should fix #417

[maxsmythe]

We should add a test to make sure things are working properly. It looks like we've been relying on integration tests to validate the namespace name code.

The basic tests for by-name namespace matching are here:

gatekeeper/pkg/target/target_integration_test.go

Lines 132 to 145 in 0e6879a

	{
	name: "match namespace",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setNamespaceName("my-ns")),
	allowed: false,
	},
	{
	name: "no match namespace",
	obj: makeResource("some", "Thing"),
	ns: makeNamespace("my-ns"),
	constraint: makeConstraint(setNamespaceName("not-my-ns")),
	allowed: true,
	},

This function was used to set the namespace-name match criteria on the test constraint, a similar one can be used to set excludedNamespaces:

gatekeeper/pkg/target/target_integration_test.go

Lines 81 to 87 in 0e6879a

	func setNamespaceName(name string) buildArg {
	return func(obj *unstructured.Unstructured) {
	if err := unstructured.SetNestedSlice(obj.Object, []interface{}{name}, "spec", "match", "namespaces"); err != nil {
	panic(err)
	}
	}
	}

Adding two new tests that use the newly written function should be sufficient for this PR.

For the project generally, we should add tests for the special object-under-test-is-a-namespace case for all the match criteria, given all the special handling it requires (this last point is not feedback for this PR).

[jeffa5]

Thanks for the comments, I've added the tests and renamed the things 😄

[maxsmythe]

LGTM

This is awesome! Thanks!

[jeffa5]

Thanks!

Is it planned to have a new release soon that would include this or is it possible to cut one?

[maxsmythe]

I don't think we have a set release cadence yet (something we could work on), but I think we can cut a release this week or next.

It's also possible to build from head using make docker-build REGISTRY=<YOUR DOCKER REGISTRY> and make docker-push-release REGISTRY=<YOUR DOCKER REGISTRY>

Then you can either update the gatekeeper.yaml manifest to point to the correct image or run:

make deploy REGISTRY=<YOUR DOCKER REGISTRY> while your kubernetes context is set to the cluster you want to install to.

Running make deploy should be equivalent to running kubectl apply -f manifest_staging/deploy/gatekeeper.yaml