Outcome

A new hub template variable of `.PolicyMetadata` which has the `name`, `namespace`, `labels`, and `annotations` keys with values from the root policy.

Original

As a user managing Policies in a GitOps process the same Policy will end up in multiple namespaces as determined by a release/change process.

Look up functions are limited in hub policies such that they can only gather data from the namespace where the root policy exists. In the above scenario the namespace is not known.

Leaving the namespace blank currently works, but this is not documented behavior and could change in the future.

data: '{{hub copySecretData "" "collector-tls" hub}}'

Creating a context variable "rootPolicyMetadata" which contains the namespace and name would allow for explicit notation of the namespace.

data: '{{hub copySecretData .rootPolicyMetadata.namespace "collector-tls" hub}}'

or

data: '{{hub (lookup "policy.open-cluster-management.io/v1" "Policy" .rootPolicyMetadata.namespace .rootPolicyMetadata.name).status.compliant hub}}'