fix: tweaks to avoid kyverno update conficts

vcluster/chart/templates/kyverno-policies/allow-vcluster-apiserver.yaml

@@ -0,0 +1,49 @@
+{{- $fullname := include "vCluster.fullname" . -}}
+{{- $name := include "vCluster.releaseName" . -}}
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    kyverno.io/kyverno-version: 1.7.0
+    policies.kyverno.io/description:  Allow egress to vcluster kube-apiserver
+    policies.kyverno.io/minversion: 1.7.0
+    policies.kyverno.io/subject: Namespace, NetworkPolicy
+    policies.kyverno.io/title: Generate NetworkPolicy to Existing Namespaces
+  name: allow-{{ $name }}-vcluster-apiserver
+  namespace: {{ .Release.Namespace }}
+spec:
+  background: true
+  generateExisting: true
+  rules:
+  - name: allow-{{ $name }}-vcluster-apiserver
+    generate:
+      apiVersion: cilium.io/v2
+      kind: CiliumNetworkPolicy
+      name: allow-{{ $name }}-vcluster-apiserver-access
+      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+      synchronize: true
+      data:
+        spec:
+          description: Allow egress to vcluster kube-apiserver
+          egress:
+          - toEndpoints:
+            - matchLabels:
+               app: vcluster
+            toPorts:
+            - ports:
+              - port: "443"
+                protocol: TCP
+          endpointSelector: {}
+    match:
+      any:
+      - resources:
+          kinds:
+          - Namespace
+          names:
+          - {{ $fullname }}
+      - resources:
+          kinds:
+          - Namespace
+          selector:
+            matchLabels:
+              vcluster.loft.sh/vcluster-name: {{ $fullname }}

vcluster/chart/templates/kyverno-policies/sync-vcluster-atlantis-secrets.yaml

@@ -0,0 +1,66 @@
+{{- $name := include "vCluster.releaseName" . -}}
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: "sync-{{ $name }}-vcluster-secrets"
+spec:
+  background: true
+  generateExisting: true
+  rules:
+  - name: sync-rabbitmq-secrets
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: staging-rabbitmq
+      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+      synchronize: false
+      clone:
+        namespace: rabbitmq
+        name: staging-rabbitmq
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+          - "vcluster-009dba7e-*"
+        selector:
+          matchLabels:
+            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+  - name: sync-redis-secrets
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: staging-redis
+      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+      synchronize: false
+      clone:
+        namespace: redis
+        name: staging-redis
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+          - "vcluster-009dba7e-*"
+        selector:
+          matchLabels:
+            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'
+  - name: sync-archmeister-superuser
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: '{{ $name }}-archmeister-app'
+      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+      synchronize: false
+      clone:
+        namespace: '{{ .Release.Namespace }}'
+        name: '{{ $name }}-archmeister-superuser'
+    match:
+      resources:
+        kinds:
+        - Namespace
+        names:
+          - "vcluster-009dba7e-*"
+        selector:
+          matchLabels:
+            vcluster.loft.sh/vcluster-namespace: '{{ .Release.Namespace }}'

vcluster/chart/templates/kyverno-policies/sync-vcluster-oceanbox-regcred.yaml

@@ -0,0 +1,40 @@
+{{- $fullname := include "vCluster.fullname" . -}}
+{{- $name := include "vCluster.releaseName" . -}}
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    policies.kyverno.io/category: Sample
+    policies.kyverno.io/description: 'Secrets like registry credentials often need
+      to exist in multiple Namespaces so Pods there have access. Manually duplicating
+      those Secrets is time consuming and error prone. This policy will copy a Secret
+      called `regcred` which exists in the `default` Namespace to new Namespaces when
+      they are created. It will also push updates to the copied Secrets should the
+      source Secret be changed.            '
+  creationTimestamp: "2024-01-15T11:58:24Z"
+  name: sync-{{ $name }}-vcluster-oceanbox-regcred
+spec:
+  admission: true
+  background: true
+  generateExisting: true
+  rules:
+  - generate:
+      apiVersion: v1
+      clone:
+        # name: oceanbox-regcred
+        name: gitlab-pull-secret
+        namespace: default
+      kind: Secret
+      # name: oceanbox-regcred
+      name: gitlab-pull-secret
+      namespace: {{ printf "{{request.object.metadata.name}}" | quote }}
+      synchronize: false
+    match:
+      any:
+      - resources:
+          kinds:
+          - Namespace
+          selector:
+            matchLabels:
+              vcluster.loft.sh/vcluster-name: {{ $fullname }}
+    name: sync-vcluster-oceanbox-regcred