A generate rule must create Deployments, but policy installation fails because Kyverno lacks permission to create them. Which controller's aggregated ClusterRole should be extended?

Question

Accepted Answer

B. background controller. Generate rules are handled by the background controller, so additional create or update permissions must be aggregated to that controller's ClusterRole. Option a is wrong because the admission controller is not the controller that executes standard generate rules against cluster resources.

A generate rule must create Deployments, but policy installation fails because Kyverno lacks permission to create them. Which controller's aggregated ClusterRole should be extended?

Related Questions

Discussion