restart-workloads-on-secret-change.yaml

---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restart-workloads-on-secret-change
  annotations:
    policies.kyverno.io/title: Restart workloads On Secret Change
    policies.kyverno.io/subject: Deployment, Statefulset, Daemonset
    policies.kyverno.io/description: >-
      If Secrets are mounted in ways which do not naturally allow updates to
      be live refreshed it may be necessary to modify a Deployment. This policy
      watches a Secret and if it changes will write an annotation
      to one or more target Deployments, Statefulsets or Daemonsets thus triggering a new rollout and thereby
      refreshing the referred Secret. 
spec:
  mutateExistingOnPolicyUpdate: false
  rules:
    - name: update-secret
      match:
        any:
          - resources:
              kinds:
                - Secret
              names:
                - "*"
              annotations:
                restart-workloads: "true"
      preconditions:
        all:
          - key: "{{"{{ request.operation || 'BACKGROUND' }}"}}"
            operator: Equals
            value: UPDATE
      mutate:
        targets:
          - apiVersion: apps/v1
            kind: Deployment
            namespace: "{{"{{ request.object.metadata.namespace }}"}}"
            preconditions:
              all:
                - key: "{{"{{ target.metadata.name }}"}}"
                  operator: AnyIn
                  value: "{{"{{"}} request.object.metadata.annotations.\"restart-deployments\" | split(@, ','){{"}}"}}"
          - apiVersion: apps/v1
            kind: StatefulSet
            namespace: "{{"{{ request.object.metadata.namespace }}"}}"
            preconditions:
              all:
                - key: "{{"{{ target.metadata.name }}"}}"
                  operator: AnyIn
                  value: "{{"{{"}} request.object.metadata.annotations.\"restart-statefulsets\" | split(@, ','){{"}}"}}"
          - apiVersion: apps/v1
            kind: DaemonSet
            namespace: "{{"{{ request.object.metadata.namespace }}"}}"
            preconditions:
              all:
                - key: "{{"{{ target.metadata.name }}"}}"
                  operator: AnyIn
                  value: "{{"{{"}} request.object.metadata.annotations.\"restart-daemonsets\" | split(@, ','){{"}}"}}"
        patchStrategicMerge:
          spec:
            template:
              metadata:
                annotations:
                  ops.corp.com/triggerrestart: "{{"{{request.object.metadata.resourceVersion}}"}}"

---
# ClusterRole granting permissions for Kyverno background controller to update deployments and statefulsets

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  labels:
    app.kubernetes.io/component: background-controller
    app.kubernetes.io/instance: kyverno
    app.kubernetes.io/part-of: kyverno
  name: kyverno:generate-workloads
rules:
- apiGroups:
  - apps
  resources:
  - deployments
  - statefulsets
  - daemonsets
  verbs:
  - get
  - list
  - patch
  - update
  - watch