allow multiple namespaces to be watched for policies

[janwillies]

this fixes an inconsistency with the docs:

--policies stringSlice
automatically load policies from these namespaces

but v1.NamespaceAll was hardcoded

[janwillies]

reading #11 this seems a bit more work than this?

[tsandall]

@janwillies this looks fine. I have one comment we should address but other than that, LGTM. Also, you'll need to sign-off on your changes before we can merge this.

[tsandall]

Users can deploy kube-mgmt with --policies=* in which case configmaps in all namespaces will be replicated into OPA (this is used in conjunction with --require-policy-label` to filter configmaps.)

Could you add a flag to kube-mgmt so that users can tell it to watch specific namespaces? Otherwise this change will not be backwards compatible.

[janwillies]

I'm a bit afraid that adding another parameter would maybe clutter the UI too much? Note that the help for --policies currently says:

 --policies stringSlice                automatically load policies from these namespaces (default [opa,kube-federation-scheduling-policy]) 

Can we not simply parse the --policies= parameter and in case of * use v1.NamespaceAll? Something like

	if namespaces[0] == "*" {
		namespaces[0] = v1.NamespaceAll
		namespaces = namespaces[0:1]
	}

[tsandall]

This looks fine. I would probably check whether the slice contained * at all but this will work.

[tsandall]

LGTM

[tsandall]

This looks fine. I would probably check whether the slice contained * at all but this will work.