Merge branch 'nixidy' of gitlab.com:oceanbox/manifests into nixidy

policies/oceanbox/kyverno/sync-archmaester-secrets.yaml

@@ -0,0 +1,46 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: sync-prod-archmaester-replication-secrets
+spec:
+  background: true
+  generateExisting: false
+  rules:
+  - name: sync-archmaester-ca
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: prod-archmeister-ca
+      namespace: '{{ request.object.metadata.namespace }}'
+      synchronize: true
+      clone:
+        namespace: atlantis
+        name: prod-archmeister-ca
+    match:
+     any:
+     - resources:
+         kinds:
+         - Secret
+         names:
+         - prod-archmeister-ca
+         annotations:
+           kyverno/clone: "true"
+  - name: sync-archmaester-replication
+    generate:
+      apiVersion: v1
+      kind: Secret
+      name: prod-archmeister-replication
+      namespace: '{{ request.object.metadata.namespace }}'
+      synchronize: true
+      clone:
+        namespace: atlantis
+        name: prod-archmeister-replication
+    match:
+     any:
+     - resources:
+         kinds:
+         - Secret
+         names:
+         - prod-archmeister-replication
+         annotations:
+           kyverno/clone: "true"

policies/oceanbox/kyverno/sync-atlantis-secrets.yaml

@@ -30,7 +30,7 @@ spec:
       - resources:
           annotations:
             vcluster.loft.sh/controlled-by: secret/v1/GenericImport
-  - name: sync-redis-secret
+  - name: sync-atlantis-secret
     generate:
       apiVersion: v1
       kind: Secret
@@ -38,15 +38,15 @@ spec:
       namespace: '{{ request.object.metadata.namespace }}'
       synchronize: true
       clone:
-        name: staging-redis
+        name: staging-atlantis-env
-        namespace: redis
+        namespace: staging-atlantis
     match:
      any:
      - resources:
          kinds:
          - Secret
          names:
-         - "*-redis"
+         - "*-atlantis-env"
          annotations:
            kyverno/clone: "true"
     exclude:
@@ -54,7 +54,7 @@ spec:
       - resources:
           annotations:
             vcluster.loft.sh/controlled-by: secret/v1/GenericImport
-  - name: sync-archmaester-secret
+  - name: sync-azure-keyvault-secret
     generate:
       apiVersion: v1
       kind: Secret
@@ -62,7 +62,7 @@ spec:
       namespace: '{{ request.object.metadata.namespace }}'
       synchronize: true
       clone:
-        name: prod-archmeister-superuser
+        name: azure-keyvault
         namespace: atlantis
     match:
      any:
@@ -70,55 +70,7 @@ spec:
          kinds:
          - Secret
          names:
-         - "*-db-superuser"
+         - azure-keyvault
-         annotations:
-           kyverno/clone: "true"
-    exclude:
-      any:
-      - resources:
-          annotations:
-            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
-  - name: sync-archmaester-replication-secret
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: prod-archmeister-replication
-        namespace: atlantis
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - prod-archmeister-replication
-         annotations:
-           kyverno/clone: "true"
-    exclude:
-      any:
-      - resources:
-          annotations:
-            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
-  - name: sync-archmaester-ca
-    generate:
-      apiVersion: v1
-      kind: Secret
-      name: '{{ request.object.metadata.name }}'
-      namespace: '{{ request.object.metadata.namespace }}'
-      synchronize: true
-      clone:
-        name: prod-archmeister-ca
-        namespace: atlantis
-    match:
-     any:
-     - resources:
-         kinds:
-         - Secret
-         names:
-         - prod-archmeister-ca
          annotations:
            kyverno/clone: "true"
     exclude: