Sync Secrets

Secrets like registry credentials often need to exist in multiple Namespaces so Pods there have access. Manually duplicating those Secrets is time consuming and error prone. This policy will copy a Secret called `regcred` which exists in the `default` Namespace to new Namespaces when they are created. It will also push updates to the copied Secrets should the source Secret be changed.

Policy Definition

/other/sync_secrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: sync-secrets
 5  annotations:
 6    policies.kyverno.io/title: Sync Secrets
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Secret
 9    policies.kyverno.io/description: >-
10      Secrets like registry credentials often need to exist in multiple
11      Namespaces so Pods there have access. Manually duplicating those Secrets
12      is time consuming and error prone. This policy will copy a
13      Secret called `regcred` which exists in the `default` Namespace to
14      new Namespaces when they are created. It will also push updates to
15      the copied Secrets should the source Secret be changed.      
16spec:
17  rules:
18  - name: sync-image-pull-secret
19    match:
20      resources:
21        kinds:
22        - Namespace
23    generate:
24      kind: Secret
25      name: regcred
26      namespace: "{{request.object.metadata.name}}"
27      synchronize: true
28      clone:
29        namespace: default
30        name: regcred

Create policy issue