Refresh Environment Variables in Pods

[Kamalesh-Seervi]

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: refresh-env-var-in-pods     
spec:
  mutateExistingOnPolicyUpdate: false
  rules:
  - name: refresh-from-secret-env
    match:
      any:
      - resources:
          kinds:
          - Secret
          selector:
            matchLabels:
              kyverno.io/watch: "true"
    preconditions:
      all:
      - key: "{{request.operation}}"
        operator: Equals
        value: UPDATE
    mutate:
      targets:
        - apiVersion: apps/v1
          kind: Deployment
          namespace: "{{request.namespace}}"
      patchStrategicMerge:
        spec:
          template:
            metadata:
              annotations:
                corp.org/random: "{{ random('[0-9a-z]{8}') }}"
            spec:
              containers:
              - env:
                - valueFrom:
                    secretKeyRef:
                      <(name): "{{ request.object.metadata.name }}"

I0812 18:11:24.371383       1 resource.go:53] background "msg"="fetched trigger resource"  "resourceSpec"={"apiVersion":"v1","kind":"Secret","namespace":"ns1","name":"test-secret-ns1"}
E0812 18:11:24.385963       1 update_request_controller.go:322] background "msg"="" "error"="failed to mutate existing resource, rule response3: variable substitution failed: failed to resolve random('[0-9a-z]{8}') at path /mutate/patchStrategicMerge/spec/template/metadata/annotations/corp.org/random: JMESPath query failed: unknown function: random" "apiVersion"="v1" "kind"="Secret" "name"="test-secret-ns1" "namespace"="ns1" "policy"="refresh-env-var-in-pods" 

I am using api v1 i get this is there any alternate

[chipzoller]

Please fix the formatting of your policy so we can read it.

[Kamalesh-Seervi]

My usecase is i want to restart my pod whenever a secret is updated.

[Kamalesh-Seervi]

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: refresh-env-var-in-pods     
spec:
  mutateExistingOnPolicyUpdate: false
  rules:
  - name: refresh-from-secret-env
    match:
      any:
      - resources:
          kinds:
          - Secret
          selector:
            matchLabels:
              kyverno.io/watch: "true"
    preconditions:
      all:
      - key: "{{request.operation}}"
        operator: Equals
        value: UPDATE
    mutate:
      targets:
        - apiVersion: apps/v1
          kind: Deployment
          namespace: "{{request.namespace}}"
      patchStrategicMerge:
        spec:
          template:
            metadata:
              annotations:
                corp.org/random: "{{ random('[0-9a-z]{8}') }}"
            spec:
              containers:
              - env:
                - valueFrom:
                    secretKeyRef:
                      <(name): "{{ request.object.metadata.name }}"

When i use this i get the below error

I0812 18:11:24.371383       1 resource.go:53] background "msg"="fetched trigger resource"  "resourceSpec"={"apiVersion":"v1","kind":"Secret","namespace":"ns1","name":"test-secret-ns1"}
E0812 18:11:24.385963       1 update_request_controller.go:322] background "msg"="" "error"="failed to mutate existing resource, rule response3: variable substitution failed: failed to resolve random('[0-9a-z]{8}') at path /mutate/patchStrategicMerge/spec/template/metadata/annotations/corp.org/random: JMESPath query failed: unknown function: random" "apiVersion"="v1" "kind"="Secret" "name"="test-secret-ns1" "namespace"="ns1" "policy"="refresh-env-var-in-pods"

[chipzoller]

You're applying this policy it appears, which we know works. What version of Kyverno and how are you testing this?

[chipzoller]

Transferred to discussion.

[Kamalesh-Seervi]

i used kubectl create -f https://raw.githubusercontent.com/kyverno/kyverno/release-1.7/config/release/install.yaml this

https://github.com/Kamalesh-Seervi/kyverno-testing
this is code i use create a simple setup

[Kamalesh-Seervi]

:v1.7.5 this is my kyverno version

[chipzoller]

Minimum supported version of this policy is Kyverno 1.9.0.