haydn-j-evans / golang-skeleton Goto Github PK

Certainly, syncing secrets across namespaces can be quite useful in Kubernetes clusters for a variety of reasons. Kyverno can help automate this task through its policy management capabilities.

Here's a sample Kyverno policy that clones a secret to another namespace based on a label (target-namespace) on the original secret.

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: sync-secrets
spec:
  background: false
  rules:
    - name: sync-secret-to-namespace
      match:
        resources:
          kinds:
            - Secret
      preconditions:
        any:
          - key: "{{ request.object.metadata.labels['sync-secret'] }}"
            operator: Equals
            value: "true"
      generate:
        synchronize: true
        kind: Secret
        namespace: "{{ request.object.metadata.labels['target-namespace'] }}"
        data:
          - fieldPath: metadata.name
            force: true
            name: metadata.name
          - fieldPath: data
            force: true
            name: data

Code Breakdown:

• apiVersion and kind: Specifies that this is a Kyverno ClusterPolicy.

• background: false: This policy should not be applied to existing resources, only new or modified ones.

• rules: Contains the rule definitions.

  • name: Rule name is "sync-secret-to-namespace".

  • match.resources.kinds: Apply this rule to Kubernetes Secrets.

  • preconditions: Preconditions that must be met for the rule to apply.

    • It checks for the existence of a label named sync-secret on the secret with a value of "true".

  • generate: The generate block defines what should be generated when the rule applies.

    • synchronize: true: To keep the resource in sync.

    • kind: Specifies that a Secret should be generated.

    • namespace: Takes the target namespace from the target-namespace label of the original secret.

    • data: Specifies which fields should be copied over to the new secret. Both metadata.name and data are copied over.

This isn't a one-size-fits-all solution, and also note that this policy allows secrets to be copied across namespaces, which might not be best practice from a security perspective in all cases.

Let me know if you have more questions!