{{<- if not (tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_is_cloned" .) >}}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: kubeflow-pipelines--restart-on-secret-update--mysql
spec:
  rules:
    - name: trigger-deployment-restarts
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - {{< tmpl.Exec "kubeflow_pipelines.mysql.auth.secret_name" . | quote >}}
              namespaces:
                - "kubeflow"
              operations:
                - CREATE
                - UPDATE
      preconditions:
        all:
          - key: "{{ request.operation || 'BACKGROUND' }}"
            operator: AnyIn
            value: 
              - CREATE
              - UPDATE
      mutate:
        targets:
          - apiVersion: apps/v1
            kind: Deployment
            namespace: "{{ request.object.metadata.namespace }}"
        patchStrategicMerge:
          spec:
            template:
              metadata:
                annotations:
                  deploykf.org/restart-trigger: "{{ random('[0-9a-z]{32}') }}"
              spec:
                containers:
                  - env:
                      - valueFrom:
                          secretKeyRef:
                            <(name): "{{ request.object.metadata.name }}"
{{<- end >}}