> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Any and All Statements
> Explains using Kyverno's any and all resource filters to combine matching criteria (OR and AND) with examples and evaluation behavior.
When writing Kyverno policies, you often need to express complex matching criteria. Earlier we learned how to combine filters like `kinds`, `names`, and `selector` within a single `resources` block — those are implicitly combined with logical AND. But what if you need to express alternatives (OR) or require that several independent filter blocks all match (AND)? Kyverno provides `any` and `all` for exactly this purpose.
This article explains how to use `any` (OR) and `all` (AND) resource filters in Kyverno policies, including examples and evaluation behavior so you can craft precise policy scopes.
## any (OR)
The `any` block implements logical OR. The rule matches if at least one of the filter blocks under `any` matches the resource or request.
Example: match either Deployments labeled `app: critical` OR any StatefulSet.
```yaml theme={null}
match:
any: # Match if Block 1 OR Block 2 is true
- resources: # Block 1: Critical Deployments
kinds:
- Deployment
selector:
matchLabels:
app: critical
- resources: # Block 2: All StatefulSets
kinds:
- StatefulSet
```
Behavior:
* This policy applies to a Deployment that has the `app: critical` label, or to any StatefulSet (regardless of labels).
* Use `any` when multiple, different criteria should grant a match — for example, different resource types or different identity-based rules that share the same policy action.
## Combining different filter types under `any`
Under `any` you can mix different top-level filter types, such as `resources`, `clusterRoles`, `subjects`, etc. Kyverno evaluates the blocks in order and stops as soon as one block matches.
Example: match if the resource is a Deployment OR if the requesting user has the `cluster-admin` cluster role:
```yaml theme={null}
match:
any:
# Block 1: Matches based on the resource
- resources:
kinds:
- Deployment
# Block 2: Matches based on the cluster roles of the user
- clusterRoles:
- cluster-admin
```
Evaluation notes:
* If Block 1 matches (e.g., the object is a Deployment), Kyverno considers the rule matched and will not need to evaluate further blocks.
* If Block 1 does not match, Kyverno evaluates Block 2 and checks the requester's identity. If the requester has `cluster-admin`, the rule matches regardless of the resource type.
## all (AND)
The `all` block implements logical AND. The rule matches only if every filter block listed under `all` matches. Use `all` when you require multiple independent conditions to be true simultaneously.
Example: match only Deployments that both have the label `app: critical` AND are named `frontend-app`.
```yaml theme={null}
match:
all: # Match if Block 1 AND Block 2 are true
- resources: # Block 1: Is it a critical Deployment?
kinds:
- Deployment
selector:
matchLabels:
app: critical
- resources: # Block 2: AND is its name 'frontend-app'?
kinds:
- Deployment
names:
- "frontend-app"
```
Behavior:
* A Deployment must satisfy both conditions to match: it must have the `app: critical` label and be named `frontend-app`.
* If either block fails to match, the rule will not apply.
## Quick comparison table
| Operator | Logical meaning | When to use | Example use case |
| -------- | ----------------------------------------- | ----------------------------------------------------- | ------------------------------------------------------------------- |
| `any` | OR — matches if any block is true | Broaden scope to multiple alternative targets | Apply one policy to either Deployments with a label OR StatefulSets |
| `all` | AND — matches only if all blocks are true | Narrow scope to resources that meet multiple criteria | Enforce policy only for resources with a particular name and label |
## Kyverno evaluation model
* Top-level `match` filters can be standard filters (like `resources`) or combinators (`any`/`all`).
* Kyverno evaluates the combinator blocks in sequence; for `any`, evaluation can short-circuit on the first match.
* The same combinator logic (`any`/`all`) is used in `exclude` blocks to define exceptions.
A `match` block can contain direct filter blocks (for example, `resources`) or it can use `any`/`all` to combine multiple filter blocks. Use `any` when you want OR semantics and `all` when you want AND semantics.
The `exclude` block, which creates exceptions, uses the same `any`/`all` logic — the concepts explained here apply to it as well.
That's it for this lesson.
Further reading and references:
* Kyverno documentation: [https://kyverno.io/docs/](https://kyverno.io/docs/)
* Kyverno match examples: [https://kyverno.io/docs/writing-policies/match-examples/](https://kyverno.io/docs/writing-policies/match-examples/)