Copy namespace labels to pod labels about gatekeeper HOT 2 CLOSED

Hi Mirza,

This behavior is not possible using our mutation system, and we are not planning to do anything like this because it would violate the convergence property of our mutations (e.g. another "competing" mutator could cause the tags to be endlessly flipped back and forth).

Even if we did, in my opinion, mutation is perhaps not the best tool for this job, as it would only copy the labels when the Pod objects are updated. Adding a new label to a namespace would not propagate to the Pod until the Pod goes through the mutation webhook.

I would recommend either:

1. Try solving this problem upstream, e.g. before the resources are applied to the cluster.
2. Writing a custom Kubernetes controller that watches the namespaces, and applies the relevant labels to the Pods. This way, they will always be in sync.

from gatekeeper.

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

from gatekeeper.