Kubeops Config Syncer Secret Generation From Rancher CAPI Secret

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: config-syncer-secret-generation-from-rancher-capi
  annotations:
    policies.kyverno.io/title: Kubeops Config Syncer Secret Generation From Rancher CAPI Secret
    policies.kyverno.io/category: Kubeops
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Secret
    kyverno.io/kyverno-version: 1.8.0
    policies.kyverno.io/minversion: 1.7.1
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/description: This policy generates and synchronizes a Kubeops Config Syncer merged kubeconfig Secret from Rancher managed cluster CAPI secrets. This kubeconfig Secret is required by the Kubeops Config Syncer for it to sync ConfigMaps/Secrets from the Rancher management cluster to downstream clusters.
spec:
  generateExisting: true
  rules:
    - name: source-rancher-non-local-cluster-and-capi-secret
      match:
        all:
          - resources:
              kinds:
                - provisioning.cattle.io/v1/Cluster
      exclude:
        any:
          - resources:
              namespaces:
                - fleet-local
      context:
        - name: currentKubeconfigData
          apiCall:
            urlPath: /api/v1/namespaces/kubed/secrets
            jmesPath: items[?metadata.name == 'kubed'] | [0].data.kubeconfig || ''
        - name: secretList
          apiCall:
            urlPath: /api/v1/namespaces/{{request.object.metadata.namespace}}/secrets
            jmesPath: items[?metadata.name.contains(@, '-kubeconfig')]
        - name: kubeconfigClustersData
          variable:
            value: |
              {{ secretList | [].{
                  "name": replace_all(metadata.name, '-kubeconfig', ''),
                  "cluster": data.value | base64_decode(@) | parse_yaml(@).clusters[].cluster[] | [0] } || '\[\]'
              }}
            jmesPath: to_string(@)
        - name: kubeconfigUsersData
          variable:
            value: |
              {{ secretList | [].{
                  "name": replace_all(metadata.name, '-kubeconfig', ''),
                  "user": data.value | base64_decode(@) | parse_yaml(@).users[].user[] | [0] } || '\[\]'
              }}
            jmesPath: to_string(@)
        - name: kubeconfigContextsData
          variable:
            value: |
              {{ secretList | [].{
                  "name": replace_all(metadata.name, '-kubeconfig', ''),
                  "context": ['CLUSTER_BEGIN', replace_all(metadata.name, '-kubeconfig', ''), 'CLUSTER_END', 'USER_BEGIN', replace_all(metadata.name, '-kubeconfig', ''), 'USER_END'] } || '\[\]'
              }}
            jmesPath: to_string(@) | replace_all(@, '["CLUSTER_BEGIN",', '{"cluster":') | replace_all(@, '"CLUSTER_END","USER_BEGIN",', '"user":') | replace_all(@, ',"USER_END"]', '}')
        - name: kubeconfigData
          variable:
            value: |
              {
                "apiVersion": "v1",
                "kind": "Config",
                "clusters": {{ kubeconfigClustersData }},
                "contexts": {{ kubeconfigContextsData }},
                "users": {{ kubeconfigUsersData }}
              }
            jmesPath: to_string(@)
      preconditions:
        any:
          - key: "{{ kubeconfigData || '' | base64_encode(@) }}"
            operator: NotEquals
            value: "{{ currentKubeconfigData }}"
      generate:
        synchronize: true
        apiVersion: v1
        kind: Secret
        name: kubed
        namespace: kubed
        data:
          type: Opaque
          data:
            kubeconfig: "{{ kubeconfigData || '' | base64_encode(@) }}"