Extend data replication capabilities to VAP integration

[JaydipGabani]

Describe the solution you'd like

I propose extending Gatekeeper's data replication functionality to VAP (Validation Admission Policy) integration. This would enable VAP managed by Gatekeeper to validate resources against on-cluster resources and reduce gap between rego and CEL/VAP constraints templates.

Anything else you would like to add:

Possible solution:

• Dump data.inventory to a CRD
• Use CR as paramref in VAP policy to read data from

[JaydipGabani]

Another way of doing this is figure out a way for data.inventory to be used as variable in VAP CEL directly.

[NickKeller]

I don't think you would be able to sync the entire object. You'd probably come up against the object size limit. I wonder if there could be a filter for the specific fields that the VAP needs? Realistically you don't need the entire object, just the fields you care about

[JaydipGabani]

Yip, there will need to be sharding of some sort and writing multiple objects, potentially one CR for one synced resource.