fix: add kyverno secret policies for sorcerer

policies/ekman/kyverno/sync-keyvault-secret.yaml

@@ -18,15 +18,17 @@ spec:
         namespace: sorcerer
       kind: Secret
       name: azure-keyvault
-      namespace: '{{request.object.metadata.name}}'
+      namespace: '{{request.object.metadata.namespace}}'
       synchronize: true
     match:
       any:
       - resources:
           kinds:
-          - Namespace
+          - Secret
           names:
-          - "*-sorcerer"
+          - azure-keyvault
+          annotations:
+            kyverno/clone: "true"
     name: sync-keyvault-secrets
 
 

policies/ekman/kyverno/sync-sorcerer-secrets.yaml

@@ -0,0 +1,32 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: sync-sorcerer-secrets
+spec:
+  background: true
+  generateExisting: true
+  rules:
+  - name: sync-atlantis-secret
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: '{{ request.object.metadata.name }}'
+      namespace: '{{ request.object.metadata.namespace }}'
+      synchronize: true
+      clone:
+        name: staging-sorcerer-env
+        namespace: staging-sorcerer
+    match:
+     any:
+     - resources:
+         kinds:
+         - Secret
+         names:
+         - "*-sorcerer-env"
+         annotations:
+           kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport