https://issues.redhat.com/browse/ACM-16183

governance/gatekeeper_operator/config_gk_operator.adoc

@@ -79,6 +79,11 @@ spec:
   podAnnotations:
     some-annotation: "this is a test"
     other-annotation: "another test"
+  config: <5>
+    matches: 
+      - excludedNamespaces: ["test-*", "my-namespace"] 
+        processes: ["*"] 
+    disableDefaultMatches: false <6>
 ----
 <1> For version 3.14 and later, enable the `auditEventsInvolvedNamespace` parameter to manage the namespace audit event you want to create. When you enable this parameter, the Gatekeeper controller deployment runs with the following argument: `--audit-events-involved-namespace=true`.
 <2> For version 3.14 and later, enable the `admissionEventsInvolvedNamespace` parameter to manage the namespace admission event you want to create. When you enable this parameter, the Gatekeeper controller deployment runs with the following argument: `--admission-events-involved-namespace=true`.
@@ -92,6 +97,8 @@ spec:
 - `disable-cert-rotation`
 - `client-cert-name`
 - `tls-min-version`
+<5> Use the `config` section to exclude namespaces from certain processes for all constraints on your hub cluster.
+<6> The `disableDefaultMatches` parameter is a boolean parameter that disables appending the default exempt namespaces provided by the Gatekeeper operator. By default, this parameter is set to `false` to allow the default namespaces to be appended.
 
 [#config-audit-sync]
 == Configuring _auditFromCache_ for sync details