[Bug] Sync Secrets failing to keep secrets in sync about policies HOT 4 CLOSED

Does it have to do with excluding the namespace that the clone secret is derived from?

Yes, almost certainly.

from policies.

the problem I'm trying to solve by excluding the namespace where the clone secret is is that Kyverno does not own the clone secret and it should not try to write to that namespace.

Is there another way besides rules.exclude to tell the below policy to ignore updates to the cloned secret's namespace?

      namespace: "{{ request.object.metadata.name }}"

An obvious workaround is to name the copy of the secret something else (i.e. wildcard-copy) but that's logistically complicated.

from policies.

kube-system is excluded in webhooks by default, therefore whether it's listed in the exclude block in this policy is irrelevant. Kyverno must be able to "see" admission events on clone sources, and with it being excluded in the webhook this isn't possible. You can change the webhook exclusions either during install or on day2 by modifying Kyverno's ConfigMap.

from policies.

Thanks! Please close, I've redirected this as a documentation fix. Appreciate the help!

from policies.