policy-kyverno-sync-secrets.yaml

# Use this policy to sync secrets between namespaces.
# This policy requires the Kyverno policy enforcement point to be installed
# separately.  The policy is based off of a kyverno community policy
# located here: https://kyverno.io/policies/other/sync_secrets/
apiVersion: policy.open-cluster-management.io/v1
kind: Policy
metadata:
  name: policy-kyverno-sync-secrets
  annotations:
    policy.open-cluster-management.io/standards: NIST SP 800-53
    policy.open-cluster-management.io/categories: CM Configuration Management
    policy.open-cluster-management.io/controls: CM-2 Baseline Configuration
spec:
  remediationAction: inform
  disabled: false
  policy-templates:
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: ConfigurationPolicy
        metadata:
          name: policy-kyverno-sync-secrets
        spec:
          remediationAction: inform # will be overridden by remediationAction in parent policy
          severity: low
          object-templates:
            - complianceType: musthave
              objectDefinition:
                apiVersion: kyverno.io/v1
                kind: ClusterPolicy
                metadata:
                  name: sync-secrets
                  annotations:
                    policies.kyverno.io/title: Sync Secrets
                    policies.kyverno.io/category: Sample
                    policies.kyverno.io/subject: Secret
                    policies.kyverno.io/description: >-
                      Secrets like registry credentials often need to exist in multiple
                      Namespaces so Pods there have access. Manually duplicating those Secrets
                      is time consuming and error prone. This policy will copy a
                      Secret called `regcred` which exists in the `default` Namespace to
                      new Namespaces when they are created. It will also push updates to
                      the copied Secrets should the source Secret be changed.      
                spec:
                  rules:
                  - name: sync-image-pull-secret
                    match:
                      resources:
                        kinds:
                        - Namespace
                    generate:
                      kind: Secret
                      name: regcred
                      namespace: "{{ `{{request.object.metadata.name}}` }}"
                      synchronize: true
                      clone:
                        namespace: default
                        name: regcred
---
apiVersion: policy.open-cluster-management.io/v1
kind: PlacementBinding
metadata:
  name: binding-policy-kyverno-sync-secrets
placementRef:
  name: placement-policy-kyverno-sync-secrets
  kind: PlacementRule
  apiGroup: apps.open-cluster-management.io
subjects:
  - name: policy-kyverno-sync-secrets
    kind: Policy
    apiGroup: policy.open-cluster-management.io
---
apiVersion: apps.open-cluster-management.io/v1
kind: PlacementRule
metadata:
  name: placement-policy-kyverno-sync-secrets
spec:
  clusterConditions:
    - status: "True"
      type: ManagedClusterConditionAvailable
  clusterSelector:
    matchExpressions:
      - {key: environment, operator: In, values: ["dev"]}