apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: gen-role-policy
spec:
  background: false
  rules:
  - name: gen-role
    match:
      any:
      - resources:
          kinds:
            - Namespace
    generate:
        kind: Role
        name: ns-role
        namespace: "{{request.object.metadata.name}}"
        synchronize: true
        data:
          rules:
          - apiGroups: [""]
            resources: ["pods"]
            verbs: ["get", "watch", "list"]
  - name: gen-role-binding
    match:
      any:
      - resources:
          kinds:
            - Namespace
    generate:
        kind: RoleBinding
        name: ns-role-binding
        namespace: "{{request.object.metadata.name}}"
        synchronize: true
        data:
          subjects:
            - apiGroup: rbac.authorization.k8s.io
              kind: User
              name: minikube-user
          roleRef:
            kind: Role
            name: ns-role
            namespace: "{{request.object.metadata.name}}"
            apiGroup: rbac.authorization.k8s.io
