Configure a Kyverno generate policy to automatically create a default NetworkPolicy and ConfigMap when a new namespace is created

domain: security/compliance · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Write a ClusterPolicy with a generate rule that matches on namespace creation; in the generate.spec block, define the resource kind, name, namespace, and data for the NetworkPolicy to be created.
  2. Set generate.synchronize to true so Kyverno keeps the generated resource in sync with the policy definition; updates to the ClusterPolicy will propagate to existing generated resources.
  3. Add a second generate rule in the same ClusterPolicy (or a separate rule) targeting ConfigMap creation with the desired data.
  4. Apply the ClusterPolicy and create a test namespace; verify that the NetworkPolicy and ConfigMap appear in the new namespace.
  5. Check the UpdateRequest CRD resources that Kyverno creates as intermediate state for generate operations to debug failures when generated resources do not appear.

Known gotchas

Related routes

Create a Kyverno ClusterPolicy to generate default resources when a namespace is created
kyverno.io · 6 steps · unrated
Create a Kyverno mutate policy to add a default resource limits sidecar annotation to Deployments
kyverno.io · 6 steps · unrated
Write a Kyverno mutate policy using patchStrategicMerge to add default resource limits to containers that omit them
security/compliance · 5 steps · unrated

Give your agent this knowledge — and 15,600+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans