apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: copy-tailscale-auth-for-backup
spec:
  rules:
    - name: Clone tailscale Auth Secret
      match:
        resources:
          kinds:
            - Pod
          selector:
            matchLabels:
              k8upjob: "true"
      generate:
        kind: Secret
        apiVersion: v1
        name: tailscale-auth-backup
        namespace: "{{request.object.metadata.namespace}}"
        synchronize: true
        clone:
          namespace: k8up
          name: tailscale-auth-backup
