Spinach documentation

[howardjones]

Is your feature request related to a problem? Please describe.
A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]

I thought it would be simple to exclude some specific alerts, but the combination of incomplete docs and (maybe) out-of-date examples makes creating a spinach.yaml harder than necessary.

Describe the solution you'd like
Actual documentation for the spinach.yaml file. For example:

• in the spinach/ examples directory, the aks and aws examples use a gvrs key that is not accepted
• in the README it says you can match fqns which seems to be namespaces (all the examples are matching namespaces, anyway). fqn is also accepted but not mentioned in the docs.

Some kind of debug logging to show if excludes are being hit would also help.

Describe alternatives you've considered
A clear and concise description of any alternative solutions or features you've considered.

Additional context
Add any other context or screenshots about the feature request here.

My simple use-case is:

• exclude POP-400 for all secrets in a namespace (we use helm-style secrets as a deployment log), as they will never be referenced
• exclude POP-400 for all secrets named helm.release.* anywhere, as they will never be referenced

popeye:
  excludes:
    linters:
      v1/secrets:
        instances:
          # the deploys namespace contains a load of unreferenced secrets and that's OK
          # all the secrets named sh.helm.release.v1.* are OK too
          - fqns: ["rx:^deploys/"]
            codes: [400]
          - fqns: ["rx:sh.helm.release"]
            codes: [400]

is not the answer though.

[derailed]

@howardjones Tx for this issue! Sorry for the confusion. I'll correct the example but I think the docs are correct.
I think you are close. As the docs indicate, you need to use the linter name vs gvr.

popeye:
  excludes:
    linters:
      secrets:
        instances:
          # the deploys namespace contains a load of unreferenced secrets and that's OK
          # all the secrets named sh.helm.release.v1.* are OK too
          - fqns: [rx:^deploys]
            codes: [400]
          - fqns: [rx:sh.helm.release]
            codes: [400]

[howardjones]

I have two questions then:

1. is fqns matching just the namespace name? the examples in the README without regexps suggest it is
2. why doesn't the spinach parser complain if you use a linter name that doesn't exist? It does for anything else...

[derailed]

@howardjones Indeed!

I'll add a new example for this. I wanted to show deltas between namespaced and non namespaced resources.
Thus for the namespace linter fqn=n.

Good point regarding linter names, I'll add a check.

[derailed]

Let's see if we're happier on v0.20.0