# A new generate rule creates a NetworkPolicy in every Namespace. What makes Kyverno also create it in Namespaces that existed before the policy?

Kyverno, Hard (Expert), Generation. https://k8wiz.com/uquiz/a-new-generate-rule-creates-a-networkpolicy-in-every-namespace-what-makes-kyverno-also-create-it-in-namespaces-that-existed-befo

- A. Setting background: false on the policy
- B. Setting synchronize: true
- C. Running 'kubectl rollout restart' on the namespaces
- D. Setting generateExisting: true on the generate rule

**Answer:** Setting generateExisting: true on the generate rule

**Explanation:** A generate rule normally fires on admission events, so Namespaces that already exist are skipped. With generateExisting: true, the background controller also processes the matching resources that exist when the policy is created. The field belongs under the rule's generate section; the spec-level version is deprecated. synchronize only controls whether Kyverno keeps generated resources in sync afterwards.