Merge remote-tracking branch 'origin/main' into nixidy

policies/oceanbox/kyverno/sync-atlantis-secrets.yaml

@@ -25,6 +25,11 @@ spec:
          - "*-rabbitmq"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-redis-secret
     generate:
       apiVersion: v1
@@ -44,6 +49,11 @@ spec:
          - "*-redis"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-secret
     generate:
       apiVersion: v1
@@ -63,6 +73,11 @@ spec:
          - "*-db-superuser"
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-replication-secret
     generate:
       apiVersion: v1
@@ -82,6 +97,11 @@ spec:
          - prod-archmeister-replication
          annotations:
            kyverno/clone: "true"
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport
   - name: sync-archmaester-ca
     generate:
       apiVersion: v1
@@ -101,11 +121,8 @@ spec:
          - prod-archmeister-ca
          annotations:
            kyverno/clone: "true"
-    # exclude:
-    #  any:
-    #  - resources:
-    #      kinds:
-    #      - Secret
-    #      selector:
-    #        matchLabels:
-    #          generate.kyverno.io/clone-source: ""
+    exclude:
+      any:
+      - resources:
+          annotations:
+            vcluster.loft.sh/controlled-by: secret/v1/GenericImport