The policy rule has generate block. It can be used for resource generation after the trigger resource has been created.

Scenario:

1. Trigger resource CREATE request.
2. Kubernetes Admission Controle forwards the request to the Kyverno Admission Webhooks.
3. Identify the policies with generate operation that apply to this resource.
4. Create a GenerateRequest resource with resource and policy identifiers. UserInfo of the api-request is also stored in the resource.
5. GenerateRequest is watched by the Generate-Policy Controller that applies the generate rules to create the resources specified in the policy. The state of the GenerateRequest status is updated to indicate the failure/success of the policy applied to the resource.

If the resource is updated policy is re-evaluated on the resource. (Only supported for Namespace resource, support for other resources to be added in future)

Generate default Networkpolicy on Namespace creation:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-networkpolicy
spec:
  rules:
  - name: default-deny-ingress
    match:
      resources: 
        kinds:
        - Namespace
        name: "*"
    generate: 
      kind: NetworkPolicy
      name: default-deny-ingress
      namespace: "{{request.object.metadata.name}}"
      data:
        spec:
          # select all pods in the namespace
          podSelector: {}
          policyTypes: 
          - Ingress```