fix: modify the source rabbitmq secret before clone

resources/atlantis/host-manifests/sync-rabbitmq-secrets.yaml

@@ -6,6 +6,21 @@ spec:
   background: true
   generateExisting: true
   rules:
+  - name: add-rabbitmq-connstring
+    mutate:
+      patchStrategicMerge:
+        stringData:
+          connString: 'amqp://user:{{ request.object.data."rabbitmq-password" | base64_decode(@) }}@{{ request.object.metadata.labels."app.kubernetes.io/instance" }}.rabbitmq.svc'
+    match:
+     any:
+       - resources:
+           kinds:
+           - Secret
+           names:
+           - prod-rabbitmq
+           - staging-rabbitmq
+           namespaces:
+           - rabbitmq
   - name: sync-prod-rabbitmq-secret
     generate:
       apiVersion: v1
@@ -56,25 +71,3 @@ spec:
          selector:
            matchLabels:
              generate.kyverno.io/clone-source: ""
-  - name: add-rabbitmq-connstring
-    mutate:
-      patchStrategicMerge:
-        stringData:
-          connString: 'amqp://user:{{ request.object.data."rabbitmq-password" | base64_decode(@) }}@{{ request.object.metadata.labels."app.kubernetes.io/instance" }}.rabbitmq.svc'
-    match:
-     any:
-       - resources:
-           kinds:
-           - Secret
-           names:
-           - prod-rabbitmq
-           - staging-rabbitmq
-           operations:
-           - UPDATE
-    exclude:
-     any:
-       - resources:
-           kinds:
-           - Namespace
-           names:
-           - rabbitmq