Merge remote-tracking branch 'origin/main' into nixidy

policies/oceanbox/kyverno/sync-atlantis-secrets.yaml

@@ -25,6 +25,11 @@ spec:
          - "*-rabbitmq"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-redis-secret
     generate:
       apiVersion: v1
@@ -44,6 +49,11 @@ spec:
          - "*-redis"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-secret
     generate:
       apiVersion: v1
@@ -63,6 +73,11 @@ spec:
          - "*-db-superuser"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-replication-secret
     generate:
       apiVersion: v1
@@ -82,6 +97,11 @@ spec:
          - prod-archmeister-replication
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-ca
     generate:
       apiVersion: v1
@@ -101,11 +121,8 @@ spec:
          - prod-archmeister-ca
          annotations:
            kyverno/clone: "true"
-    # exclude:
-    #  any:
-    #  - resources:
-    #      kinds:
-    #      - Secret
-    #      selector:
-    #        matchLabels:
-    #          generate.kyverno.io/clone-source: ""
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport

policies/oceanbox/kyverno/sync-keyvault-secret.yaml

@@ -0,0 +1,32 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  annotations:
+    policies.kyverno.io/category: Sample
+    policies.kyverno.io/description: 'Access dataprotection keys from Azure Key Vault'
+  creationTimestamp: "2024-01-15T11:58:24Z"
+  name: sync-keyvault-secrets
+spec:
+  admission: true
+  background: true
+  generateExisting: true
+  rules:
+  - generate:
+      apiVersion: v1
+      clone:
+        name: azure-keyvault
+        namespace: atlantis
+      kind: Secret
+      name: azure-keyvault
+      namespace: '{{request.object.metadata.name}}'
+      synchronize: true
+    match:
+      any:
+      - resources:
+          kinds:
+          - Namespace
+          names:
+          - "*-atlantis"
+    name: sync-keyvault-secrets
+
+

policies/oceanbox/kyverno/sync-regcred.yaml

@@ -10,7 +10,7 @@ metadata:
       they are created. It will also push updates to the copied Secrets should the
       source Secret be changed.            '
   creationTimestamp: "2024-01-15T11:58:24Z"
-  name: sync-oceanbox-regcred
+  name: sync-regcred
 spec:
   admission: true
   background: true
@@ -30,10 +30,8 @@ spec:
     exclude:
       any:
       - resources:
-          kinds:
-          - Namespace
-          names:
-          - "vcluster-*"
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
     match:
       any:
       - resources: