Namespace Inventory Check use in Enforce mode

[tanveermeman]

I am trying to Enforce Namespace Inventory Check policy for ensuring resource quota is available for the namespace.
The above policy will not allow me to create a namespace when ResourceQuota is not present for it.
And ResourceQuota cannot be created until the namespace is created.
How can I use this policy on my cluster ?
ref: https://kyverno.io/policies/other/namespace-inventory-check/namespace-inventory-check/

yaml:

apiVersion: v1
metadata:
  name: testns1
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: resource-quota
  namespace: testns1
spec:
  hard:
    requests.cpu: "4"
    requests.memory: "8Gi"
    limits.cpu: "4"
    limits.memory: "8Gi"

Policy:

kind: ClusterPolicy
metadata:
  name: namespace-inventory-check
  annotations:
    policies.kyverno.io/title: Namespace Inventory Check
    policies.kyverno.io/category: Other
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Namespace
    kyverno.io/kyverno-version: 1.9.0
    policies.kyverno.io/minversion: 1.9.0
    kyverno.io/kubernetes-version: "1.24"
    policies.kyverno.io/description: >-
      In cases such as multi-tenancy where new Namespaces must be fully
      provisioned before they can be used, it may not be easy to declare and
      understand if/when the Namespace is ready. Having a policy which defines
      all the resources which are required for each Namespace can assist in determining
      compliance. This policy, expected to be run in background mode only, performs a Namespace
      inventory check to ensure that all Namespaces have a ResourceQuota and NetworkPolicy.
      Additional rules may be written to extend the check for your needs. By default, background
      scans occur every one hour which may be changed with an additional container flag. Please
      see the installation documentation for details.
spec:
  background: true
  validationFailureAction: Enforce
  rules:
  - name: resourcequotas
    match:
      any:
      - resources:
          kinds:
          - Namespace
    exclude:
      any:
      - resources:
          namespaces:
          - kube-system
          - kube-public

    context:
    - name: resourcequotas
      apiCall:
        urlPath: "/api/v1/namespaces/{{request.object.metadata.name}}/resourcequotas"
        jmesPath: "items[] | length(@)"
    validate:
      message: "Every Namespace must have at least one ResourceQuota."
      deny:
        conditions:
          all:
          - key: "{{ resourcequotas }}"
            operator: Equals
            value: 0

Error:

admission webhook "validate.kyverno.svc-fail" denied the request: policy Namespace//testns1 for resource violation: namespace-inventory-check: resourcequotas: Every Namespace must have at least one ResourceQuota

[chipzoller]

Quote from the description:

This policy, expected to be run in background mode only,

[tanveermeman]

It is already running in background mode.
background: true
I am new to kyverno and didn't fully understand your comment.
Can you please elaborate how using background mode should solve this problem.

[chipzoller]

You cannot use this policy in Enforce mode because it cannot work there. That's the reason it's set to Audit and with background: true. If it's set to Enforce then the exact behavior you describe will happen.