Add a gator test CLI option for exit code 1 in case of enforcementAction: warn

[rquinio1A]

Describe the solution you'd like

When there's a constraint violation with enforcementAction: deny, gator test exit code is 1.
It would be useful to have a CLI option to also fail when there's a constraint violation with enforcementAction: warn (for instance --fail-on-warn).

Anything else you would like to add:

We typically use enforcementAction: warn for new constraints, to let users time to adapt, before changing them to enforcementAction: deny.
So users need an easy way to fail their gitops CI, which is typically based on exit codes.

Environment:

• Gatekeeper version: gator v3.13.0
• Kubernetes version: (use kubectl version): n/a

[davis-haba]

Hi,

We are actively working on designing a feature to allow for different enforcementActions across different enforcement points (e.g. gator/Audit/Webhook). I've linked this issue in the design, and we'll take this use case into account.

Thanks for the feedback!

[sozercan]

cc @salaxander

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[rquinio1A]

Should still be valid

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[rquinio1A]

Still valid, but could be closed as duplicate once there's a master issue about enforcementActions re-design.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[maxsmythe]

@JaydipGabani I think this is interesting WRT multi enforcement action

[JaydipGabani]

@maxsmythe are you thinking we could provide a way on constraint to include what to do for gator? something like this?

action: warn
enforcementPoints:
- name: gator
   behavior: fail

[maxsmythe]

Yep! Though it'd probably be just another enforcementAction

[JaydipGabani]

@rquinio1A We are currenlty implementing this design, after which it should be possible to define different behaviors for audit, gator cli and webhook on constraints. It would be possible to define the specific behavior - "I want to get denied for gator cli but just warnings in webhook if the resource is violating the constraint". Would this cover the ask here?

[rquinio1A]

@JaydipGabani That would be perfect!