helm install nginx-ingress oci://ghcr.io/nginxinc/charts/nginx-ingress --version 0.17.1

cat <<EOF | helm install kyverno kyverno/kyverno -n kyverno --create-namespace --wait -f -
backgroundController:
  rbac:
    clusterRole:
      extraResources:
      - apiGroups:
          - kyverno.io
        resources:
          - policies
        verbs:
          - create
EOF

> k api-resources | grep -w policies
policies                          pol          k8s.nginx.org/v1                       true         Policy
policies                          pol          kyverno.io/v1                          true         Policy

❯ k auth can-i create policy --as system:serviceaccount:kyverno:kyverno-background-controller
no

❯ k auth can-i create policy.kyverno.io --as system:serviceaccount:kyverno:kyverno-background-controller
yes

❯ cat <<EOF | kubectl apply -f -
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-namespace-label
spec:
  validationFailureAction: Enforce
  rules:
    - name: require-labels
      match:
        all:
        - resources:
            kinds:
              - Namespace
      validate:
        pattern:
          metadata:
            labels:
              AppID: "?*"
    - name: generate-add-labels-policy
      match:
        all:
        - resources:
            kinds:
              - Namespace
      generate:
        synchronize: true
        apiVersion: kyverno.io/v1
        kind: Policy
        name: add-labels-policy
        namespace: '{{request.object.metadata.name}}'
        data:
          spec:
            rules:
            - name: add-labels
              match:
                all:
                - resources:
                    kinds:
                    - Pod
                    - Service
                    - PersistentVolumeClaim
              mutate:
                patchStrategicMerge:
                  metadata:
                    labels:
                      AppID: '{{request.object.metadata.labels.AppID}}'
EOF

clusterpolicy.kyverno.io/require-namespace-label created

Error from server: error when creating "STDIN": admission webhook "validate-policy.kyverno.svc" denied the request: path: spec.rules[1].generate..: kyverno does not have permissions to 'create' resource Policy/{{request.object.metadata.name}}. Grant proper permissions to the background controller

❯ cat <<EOF | helm upgrade kyverno kyverno/kyverno -n kyverno -f -
backgroundController:
  rbac:
    clusterRole:
      extraResources:
      - apiGroups:
          - '*'
        resources:
          - policies
        verbs:
          - create
EOF