apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: existing-basic-create-policy-data
spec:
  generateExisting: true
  rules:
  - name: existing-basic-create-rule
    match:
      any:
      - resources:
          kinds:
          - Namespace
          selector:
            matchLabels:
              color: red
    generate:
      kind: NetworkPolicy
      apiVersion: networking.k8s.io/v1
      name: default-deny
      namespace: "{{request.object.metadata.name}}"
      synchronize: true
      data:
        metadata:
          labels:
            created-by: kyverno
        spec:
          podSelector: {}
          policyTypes:
          - Ingress
          - Egress