fix: misc attempts at fixing UR loops in kyverno

vcluster/chart/templates/allow-vcluster-atlantis-services.yaml

@@ -11,18 +11,19 @@ spec:
     generate:
       apiVersion: cilium.io/v2
       kind: CiliumNetworkPolicy
-      name: allow-atlantis-services
+      name: "allow-{{ $name }}-atlantis-services"
       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
       synchronize: true
       clone:
         namespace: atlantis
         name: allow-atlantis-services
     match:
-      resources:
-        kinds:
-        - Namespace
-        names:
+      any:
+      - resources:
+          kinds:
+          - Namespace
+          names:
           - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+          selector:
+            matchLabels:
+              vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'

vcluster/chart/templates/generate-cnp-rules.yaml

@@ -1,5 +1,5 @@
 {{- $fullname := include "vCluster.fullname" . -}}
-{{- $name := include "vCluster.fullname" . -}}
+{{- $name := include "vCluster.releaseName" . -}}
 apiVersion: kyverno.io/v1
 kind: ClusterPolicy
 metadata:
@@ -9,23 +9,20 @@ metadata:
     policies.kyverno.io/minversion: 1.7.0
     policies.kyverno.io/subject: Namespace, NetworkPolicy
     policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
-  name: generate-vcluster-apiserver-networkpolicy
+  name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
   namespace: {{ .Release.Namespace }}
 spec:
   background: true
   generateExisting: true
   rules:
-  - name: generate-vcluster-apiserver-networkpolicy
+  - name: generate-{{ $name }}-vcluster-apiserver-networkpolicy
     generate:
       apiVersion: cilium.io/v2
       kind: CiliumNetworkPolicy
-      name: allow-vcluster-apiserver-access
+      name: allow-{{ $name }}-vcluster-apiserver-access
       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
       synchronize: true
       data:
-        metadata:
-          labels:
-            created-by: kyverno
         spec:
           description: Allow egress to vcluster kube-apiserver
           egress:
@@ -50,4 +47,3 @@ spec:
           selector:
             matchLabels:
               vcluster.loft.sh/vcluster-name: {{ $fullname }}
-

vcluster/chart/templates/sync-vcluster-atlantis-secrets.yaml

@@ -1,66 +1,66 @@
-{{- $name := include "vCluster.releaseName" . -}}
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: "sync-{{ $name }}-vcluster-secrets"
-spec:
-  background: true
-  generateExisting: true
-  rules:
-  - name: sync-rabbitmq-secrets
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: staging-rabbitmq
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
-      clone:
-        namespace: rabbitmq
-        name: staging-rabbitmq
-    match:
-      resources:
-        kinds:
-        - Namespace
-        names:
-          - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
-  - name: sync-redis-secrets
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: staging-redis
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
-      clone:
-        namespace: redis
-        name: staging-redis
-    match:
-      resources:
-        kinds:
-        - Namespace
-        names:
-          - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
-  - name: sync-archmeister-superuser
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ $name }}-archmeister-app'
-      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
-      synchronize: true
-      clone:
-        namespace: '{{ .Release.Namespace }}'
-        name: '{{ $name }}-archmeister-superuser'
-    match:
-      resources:
-        kinds:
-        - Namespace
-        names:
-          - "vcluster-009dba7e-*"
-        selector:
-          matchLabels:
-            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+# {{- $name := include "vCluster.releaseName" . -}}
+# apiVersion: kyverno.io/v1
+# kind: ClusterPolicy
+# metadata:
+#   name: "sync-{{ $name }}-vcluster-secrets"
+# spec:
+#   background: true
+#   generateExisting: true
+#   rules:
+#   - name: sync-rabbitmq-secrets
+#     generate:
+#       apiVersion: v1
+#       kind: Secret
+#       name: staging-rabbitmq
+#       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+#       synchronize: true
+#       clone:
+#         namespace: rabbitmq
+#         name: staging-rabbitmq
+#     match:
+#       resources:
+#         kinds:
+#         - Namespace
+#         names:
+#           - "vcluster-009dba7e-*"
+#         selector:
+#           matchLabels:
+#             vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+#   - name: sync-redis-secrets
+#     generate:
+#       apiVersion: v1
+#       kind: Secret
+#       name: staging-redis
+#       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+#       synchronize: true
+#       clone:
+#         namespace: redis
+#         name: staging-redis
+#     match:
+#       resources:
+#         kinds:
+#         - Namespace
+#         names:
+#           - "vcluster-009dba7e-*"
+#         selector:
+#           matchLabels:
+#             vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+#   - name: sync-archmeister-superuser
+#     generate:
+#       apiVersion: v1
+#       kind: Secret
+#       name: '{{ $name }}-archmeister-app'
+#       namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+#       synchronize: true
+#       clone:
+#         namespace: '{{ .Release.Namespace }}'
+#         name: '{{ $name }}-archmeister-superuser'
+#     match:
+#       resources:
+#         kinds:
+#         - Namespace
+#         names:
+#           - "vcluster-009dba7e-*"
+#         selector:
+#           matchLabels:
+#             vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'