Kyverno
Hard
Generation
A new generate rule creates a NetworkPolicy in every Namespace. What makes Kyverno also create it in Namespaces that existed before the policy?
Select your answer:
Show answer and explanation
Answer: Setting generateExisting: true on the generate rule
Explanation
A generate rule normally fires on admission events, so Namespaces that already exist are skipped. With generateExisting: true, the background controller also processes the matching resources that exist when the policy is created. The field belongs under the rule's generate section; the spec-level version is deprecated. synchronize only controls whether Kyverno keeps generated resources in sync afterwards.
More hard Kyverno questions
- Which label makes Kyverno delete a resource automatically after a set amount of time?
- A Kyverno verifyImages rule has mutateDigest: true. What does it do once the signature is verified?
- In a Kyverno mutate overlay (patchStrategicMerge), what does the +() anchor do, as in '+(imagePullPolicy): IfNotPresent'?
- In a Kyverno validate pattern, what does the X() negation anchor mean, as in 'X(hostPath): "null"'?
- Which Kyverno resource exempts specific resources from a policy rule without editing the policy?
- What does the 'kyverno test' command read to run policy tests?