Brandon Hops

> I will leave this issue open for a little while, as I want to get some more feedback. The issue as originally opened asks for tags on ASGs, but...

Upon digging into this a lot further it seems like this may not be intended functionality (there's a few structures in the gatekeeper resources that follow a similar pattern of...

I agree that you could bypass the policies if they only apply to specific versions but the intention here was actually to specifically enable that possibility. The use case that...

This would also mirror the functionality of the admission webhook’s MatchPolicy field, which allows for “exact” or “equivalent” version matching. Where with exact matching, v1/Pod could go through the webhook...

> Another way of doing this could be to parameterize a constraint template with a list of GVK combinations that it should reject. E.g.: > > ``` > apiVersion: constraints.gatekeeper.sh...

> This is a useful feature, but we're wary of adding more instance selector options to eksctl to avoid bloating it with features only few are using. We're going to...

@akestner For my use case this looks like it would satisfy our requirements. This actually looks more flexible, since it seems like we can do things like the following. ```yaml...