C SToday's lesson: Using #kyverno you can configure cluster policies to replicate secrets from a reference namespace to any set of arbitrary destination namespaces.
However, one needs to ensure that the proper events are used to trigger the policy - we don't just want to copy secrets on namespace creation, but also when namespaces are updated, and for any eligible namespace at the time the policy was created. We also want to ensure that destinations secrets are updated when the source secret changes.
Kyverno makes this simple with a few features:
* The `synchronize: true` parameter for its cluster policy will create secrets for new eligible namespaces, and update secrets when the source secret changes.
* With `generateExisting: true`, a background job is created when the policy is instantiated to retroactively make it apply to existing namespaces.
Finally, with the recently released Kyverno version 1.15, new CEL-based policy types are available that are even more flexible and powerful.
https://kyverno.io/docs/policy-types/cluster-policy/generate/#clone-examples
https://kyverno.io/docs/policy-types/cluster-policy/generate/#generate-for-existing-resources
Arena Cops 🇺🇦✌