[ShreyanshK1103]

Explanation

This PR adds a new downstreamOwnership configuration to GeneratingPolicy evaluation. It allows users to choose whether generated downstream resources are managed by the specific trigger that created them or by any matching trigger belonging to the same policy. The default behavior remains Trigger to preserve existing behavior.

Related issue

Related to kyverno/kyverno#18119

Proposed Changes

• Add the DownstreamOwnership type with the following supported values:

• Trigger — the current behavior, where a downstream resource is managed only by the trigger that created it.

• Policy — allows matching triggers from the same policy to manage a shared downstream resource.

• Add the downstreamOwnership field to GeneratingPolicyEvaluationConfiguration.

• Set the default value to Trigger.

• Add CRD validation restricting the value to Trigger or Policy.

• Regenerate the affected CRDs and API documentation.

The API addition is intended to provide the configuration required for GeneratingPolicy to support shared downstream resources, matching the behavior available with legacy ClusterPolicy generate.

Checklist

• I have read the contributing guidelines.
• I have read the PR documentation guide and followed the process including adding proof manifests to this PR.
• This is a bug fix and I have added unit tests that prove my fix is effective.

Further Comments

The Trigger default preserves the existing ownership semantics, while Policy provides an explicit opt-in for shared downstream resources. The implementation of the ownership behavior will be handled in the Kyverno repository.