Sync Secrets

Secrets like registry credentials often need to exist in multiple Namespaces so Pods there have access. Manually duplicating those Secrets is time consuming and error prone. This policy will copy a Secret called `regcred` which exists in the `default` Namespace to new Namespaces when they are created. It will also push updates to the copied Secrets should the source Secret be changed.

Policy Definition

/other/sync_secrets.yaml

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: sync-secrets
 5  annotations:
 6    policies.kyverno.io/title: Sync Secrets 
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Secret
 9    policies.kyverno.io/description: >-
10      Secrets like registry credentials often need to exist in multiple
11      Namespaces so Pods there have access. Manually duplicating those Secrets
12      is time consuming and error prone. This policy will copy a
13      Secret called `regcred` which exists in the `default` Namespace to
14      new Namespaces when they are created. It will also push updates to
15      the copied Secrets should the source Secret be changed.      
16spec:
17  background: false
18  rules:
19  - name: sync-image-pull-secret
20    match:
21      resources:
22        kinds:
23        - Namespace
24    generate:
25      kind: Secret
26      name: regcred
27      namespace: "{{request.object.metadata.name}}"
28      synchronize: true
29      clone:
30        namespace: default
31        name: regcred

Create policy issue