Steven E. Harris

> The thing is that annotations are structured whereas labels must have simple string values. E.g. if I have the annotation: > > `{"one": "a", "two": "b"}` > > and...

In an appeal to prior art, note that both _kustomize_ and Kyverno allow selecting target objects by annotation selectors. Kyverno has [an example](https://kyverno.io/docs/writing-policies/match-exclude/#match-all-pods-using-annotations) in its documentation, and _kustomize_ allows such...

Would the Gatekeeper project be amenable to a patch implementing this proposed capability, or are you collectively opposed to the idea?

Well, that was insulting.

Yes, that would satisfy my needs. What other options would we be eschewing there? Matching by regular expression?

What counts as "activity?"

It turns out that the `KeysetItem.Certificate` field is nil in all but the last two items in my key set. I added some output to `(*OIDCKeys).Open`. It reports the following:...

If I add the following guard condition to `(*OIDCKeys).Open`, it looks like it will filter the key set items down to just those that contain a certificate for the common...

Note that the _kops get keypairs_ subcommand fails similarly, due to [assuming that every key set item contains an X.509 certificate](https://sourcegraph.com/github.com/kubernetes/kops@939a62e424d01b89feedfac1e93cb872329df9ff/-/blob/cmd/kops/get_keypairs.go?L124-L127). ``` % kops get keypairs panic: runtime error: invalid...

> Would you like to continue to iterate on the fix? Yes, though it would help to hear whether or not these entries that lack certificates are valid. Can _kOps_...