match on namespaces that have privileged-movers label -- not just def…

…ault
onedr0p · Oct 22, 2024 · fae9822 · fae9822
1 parent 38cf6d9
commit fae9822
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/kubernetes/main/apps/kyverno/kyverno/policies/volsync-movers.yaml b/kubernetes/main/apps/kyverno/kyverno/policies/volsync-movers.yaml
@@ -14,13 +14,17 @@ spec:
   rules:
     - name: set-volsync-movers-custom-config
       match:
-        any:
+        all:
           - resources:
               kinds: ["batch/v1/Job"]
-              namespaces: ["default"]
               selector:
                 matchLabels:
                   app.kubernetes.io/created-by: volsync
+          - resources:
+              kinds: ["batch/v1/Job"]
+              namespaceSelector:
+                matchLabels:
+                  volsync.backube/privileged-movers: "true"
       mutate:
         patchStrategicMerge:
           spec: