
Mutation lets Kyverno modify resources—either as they’re admitted or by updating existing cluster resources—to automatically bring them into compliance without blocking developers.
cost-center label so finance can bill and report accurately. Developers, focused on shipping code, often forget this administrative label.




- Strategic Merge Patch — a simple way to add or update fields (common for adding labels or annotations).
- JSON Patch (RFC 6902) — precise, surgical updates such as removing fields or inserting items at a specific index.
- Conditional logic with preconditions — apply mutations only when certain conditions are met (for example, only add the label if it’s missing).
- Mutating existing resources — find and fix objects that are already running in the cluster.
- forEach syntax — iterate over lists (e.g., inject a sidecar or mutate each container in a Deployment).
- Improves developer experience by fixing policy issues automatically.
- Ensures consistent metadata and configuration across workloads.
- Reduces support load and accelerates delivery while keeping compliance intact.
cost-center label
metadata.labels.cost-center=finance to Deployments that arrive without the label. For more surgical operations—like removing specific keys—use JSON Patch (RFC 6902).
Resources and further reading
- Kyverno: https://kyverno.io/
- JSON Patch (RFC 6902): https://tools.ietf.org/html/rfc6902
- Kubernetes Policies and Admission Controllers: https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/
Mutation is powerful and can overwrite fields. Test policies in a staging environment and use
validation rules or rigorous preconditions where you need to avoid unintended changes.