fix: fix atlantis secrets policies

This commit is contained in:
2024-11-20 20:09:22 +01:00
parent 35b5882d3e
commit c75378a0e3
@@ -25,7 +25,7 @@ spec:
- "*-rabbitmq" - "*-rabbitmq"
annotations: annotations:
kyverno/clone: "true" kyverno/clone: "true"
- name: sync-redis-secret - name: sync-atlantis-secret
generate: generate:
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
@@ -33,18 +33,18 @@ spec:
namespace: '{{ request.object.metadata.namespace }}' namespace: '{{ request.object.metadata.namespace }}'
synchronize: true synchronize: true
clone: clone:
name: staging-redis name: staging-atlantis-env
namespace: redis namespace: staging-atlantis
match: match:
any: any:
- resources: - resources:
kinds: kinds:
- Secret - Secret
names: names:
- "*-redis" - "*-atlantis-env"
annotations: annotations:
kyverno/clone: "true" kyverno/clone: "true"
- name: sync-archmaester-secret - name: sync-azure-keyvault-secret
generate: generate:
apiVersion: v1 apiVersion: v1
kind: Secret kind: Secret
@@ -52,7 +52,7 @@ spec:
namespace: '{{ request.object.metadata.namespace }}' namespace: '{{ request.object.metadata.namespace }}'
synchronize: true synchronize: true
clone: clone:
name: prod-archmeister-superuser name: azure-keyvault
namespace: atlantis namespace: atlantis
match: match:
any: any:
@@ -60,52 +60,6 @@ spec:
kinds: kinds:
- Secret - Secret
names: names:
- "*-db-superuser" - azure-keyvault
annotations: annotations:
kyverno/clone: "true" kyverno/clone: "true"
- name: sync-archmaester-replication-secret
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: prod-archmeister-replication
namespace: atlantis
match:
any:
- resources:
kinds:
- Secret
names:
- prod-archmeister-replication
annotations:
kyverno/clone: "true"
- name: sync-archmaester-ca
generate:
apiVersion: v1
kind: Secret
name: '{{ request.object.metadata.name }}'
namespace: '{{ request.object.metadata.namespace }}'
synchronize: true
clone:
name: prod-archmeister-ca
namespace: atlantis
match:
any:
- resources:
kinds:
- Secret
names:
- prod-archmeister-ca
annotations:
kyverno/clone: "true"
# exclude:
# any:
# - resources:
# kinds:
# - Secret
# selector:
# matchLabels:
# generate.kyverno.io/clone-source: ""