Constraint Kinds Matcher Question

[MarkVLK]

On the Gatekeeper Constraints docs it is mentioned that:

kinds accepts a list of objects with apiGroups and kinds fields that list the groups/kinds of objects to which the constraint will apply. If multiple groups/kinds objects are specified, only one match is needed for the resource to be in scope.

From this I take it that if you wanted to have a required label constraint apply to Pod and Namespace resources, you would have something like the following in your constraint:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: ns-must-have-gk
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace"]
      - apiGroups: [""]
        kinds: ["Pod"]
  parameters:
    labels: ["gatekeeper"]

However, I'm curious if you could instead do the following:

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata:
  name: ns-must-have-gk
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Namespace", "Pod"]
  parameters:
    labels: ["gatekeeper"]

Are these two constraints functionally the same? Or is one of them improper syntax/usage?

Assuming they are functionally the same, I'm trying to understand why you would use one over the other, unless the apiGroups and kinds are ANDed within each object in the spec.match.kinds list.

From what I can tell in my testing with gator CLI, the following two constraints have the same effect:

Constraint 1

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: repo-is-private-ecr
spec:
  match:
    kinds:
      - apiGroups: ["apps", ""]
        kinds: ["Pod", "Deployment"]
    namespaces:
      - "default"
  parameters:
    repos:
      - "111222333444.dkr.ecr.us-east-1.amazonaws.com/"

Constraint 2

apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sAllowedRepos
metadata:
  name: repo-is-private-ecr
spec:
  match:
    kinds:
      - apiGroups: [""]
        kinds: ["Pod"]
      - apiGroups: ["apps", ""]
        kinds: ["Deployment"]
    namespaces:
      - "default"
  parameters:
    repos:
      - "111222333444.dkr.ecr.us-east-1.amazonaws.com/"

[maxsmythe]

Functionally the same :)

The reason for having multiple ways of expressing things is that it's possible for one approach to be more efficient than the other in some circumstances.