Annotation-based ignore

[mrueg]

It would be interesting to extend the rego library with support for an annotation-based ignore.
An annotation could look like the following

konstraint/ignore: POL-0001, POL-0003

the logic could then allow to check for annotations on the object to ignore specific policies.

The policies itself should have a variable that allow this behavior, as the default should still be to enforce.

[jalseth]

Hi @mrueg, thanks for filing this issue. If I understand correctly, the ask here is to add a rule that would except any resources with a label from a policy that matches one in a konstraint/ignore (or similar) annotation?

If so, I'd welcome a PR to add this to the examples to show what is possible.