{{- if and .Values.deployKF.kyverno.clusterPolicies.imagePullSecrets.enabled .Values.deployKF.kyverno.clusterPolicies.imagePullSecrets.registryCredentials }}
{{- $exclude_namespaces := .Release.Namespace | append .Values.deployKF.kyverno.clusterPolicies.imagePullSecrets.excludeNamespaces | uniq }}
{{- $target_secret_names := list }}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: clone-image-pull-secrets
  annotations:
    ## we must sync kyverno resources after kyverno itself
    argocd.argoproj.io/sync-wave: "10"
    ## kyverno policies with "generate" cant be updated: https://github.com/kyverno/kyverno/issues/7718
    argocd.argoproj.io/sync-options: Replace=true
    ## we don't want auto-generation of rules for deployments/etc. https://kyverno.io/docs/writing-policies/autogen/
    pod-policies.kyverno.io/autogen-controllers: "none"
spec:
  generateExisting: true
  rules:
    {{- $this_policy_name := "clone-image-pull-secrets" }}
    {{- range $index, $credentials := .Values.deployKF.kyverno.clusterPolicies.imagePullSecrets.registryCredentials }}
    {{- $source_secret__name := $credentials.existingSecret }}
    {{- $source_secret__namespace := $credentials.existingSecretNamespace | default $.Release.Namespace }}
    {{- $target_secret__name := printf "cloned--image-pull-secret-%d" $index }}
    {{- $target_secret_names = $target_secret__name | append $target_secret_names }}
    ## clone secret {{ $index }} from its source namespace into ALL namespaces
    - name: {{ printf "clone-image-pull-secret-%d" $index | quote }}
      match:
        any:
          - resources:
              kinds:
                - Namespace
      exclude:
        any:
          - resources:
              names: {{ $exclude_namespaces | toJson }}
      generate:
        apiVersion: v1
        kind: Secret
        name: {{ $target_secret__name | quote }}
        namespace: {{ `"{{ request.object.metadata.name }}"` }}
        synchronize: true
        clone:
          namespace: {{ $source_secret__namespace | quote }}
          name: {{ $source_secret__name | quote }}

    ## annotate the ~cloned~ secret so that ArgoCD ignores it
    - name: {{ printf "annotate-cloned-secret-%d" $index | quote }}
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - {{ $target_secret__name | quote }}
              operations:
                - CREATE
                - UPDATE
              selector:
                matchLabels:
                  generate.kyverno.io/policy-name: {{ $this_policy_name | quote }}
      exclude:
        any:
          - resources:
              namespaces: {{ $exclude_namespaces | toJson }}
      mutate:
        patchStrategicMerge:
          metadata:
            annotations:
              argocd.argoproj.io/compare-options: IgnoreExtraneous
              argocd.argoproj.io/sync-options: Prune=false
    {{- end }}

    ## add all the ~cloned~ secrets to the list of imagePullSecrets for all pods
    - name: add-image-pull-secrets-to-pods
      match:
        any:
          - resources:
              kinds:
                - Pod
              operations:
                - CREATE
      exclude:
        any:
          - resources:
              namespaces: {{ $exclude_namespaces | toJson }}
      mutate:
        ## NOTE: we use an append patch here because we don't want to overwrite any existing imagePullSecrets
        patchesJson6902: |-
          {{- range $secret_name := $target_secret_names }}
          - op: add
            path: "/spec/imagePullSecrets/-"
            value:
              name: {{ $secret_name | quote }}
          {{- end }}
{{- end }}