Demo Exclude Statements

This lesson shows how to combine match and exclude statements in a Kyverno policy to enforce labels selectively. Goal

Require a Pod to have an env label when it is created in the monitoring namespace.
Exempt Pods that have the team=operations label (those Pods are excluded from the policy).

Policy definition Below is the ClusterPolicy that enforces this behavior. The match block narrows the policy scope to Pods in the monitoring namespace. The exclude block creates an exception for Pods with the team: operations label.

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-env-label
spec:
  rules:
    - name: check-env-label
      match:
        resources:
          kinds:
            - Pod
          namespaces:
            - monitoring
      exclude:
        resources:
          selector:
            matchLabels:
              team: operations
      validate:
        failureAction: Enforce
        message: "Pods in the monitoring namespace (except team=operations) must have the 'env' label."
        pattern:
          metadata:
            labels:
              env: "?*"

Apply the policy Run the following to create the ClusterPolicy in your cluster:

cat <<'EOF' | kubectl apply -f -
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-env-label
spec:
  rules:
    - name: check-env-label
      match:
        resources:
          kinds:
            - Pod
          namespaces:
            - monitoring
      exclude:
        resources:
          selector:
            matchLabels:
              team: operations
      validate:
        failureAction: Enforce
        message: "Pods in the monitoring namespace (except team=operations) must have the 'env' label."
        pattern:
          metadata:
            labels:
              env: "?*"
EOF

Expected response:

clusterpolicy.kyverno.io/require-env-label created

Verify the policy:

kubectl get cpol require-env-label

Example output:

NAME               ADMISSION   BACKGROUND   READY   AGE   MESSAGE
require-env-label  true        true         True    10s   Ready

Create the monitoring namespace (if it doesn’t exist):

kubectl create namespace monitoring

Expected response:

namespace/monitoring created

Tests Below are three tests demonstrating how match and exclude interact.

Test	Command	Expected result
1 — Pod without `env` label (should be blocked)	`kubectl run my-pod --image=nginx -n monitoring --restart=Never`	Denied by Kyverno validation webhook because the Pod matches `match` and is not excluded.
2 — Pod with wrong label name (should also be blocked)	`kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=teams=operations`	Denied — label key must be `team`, so the Pod is not excluded.
3 — Pod with `team=operations` (should be allowed)	`kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=team=operations`	Allowed — the `exclude` selector matches and the policy is not applied.

Test 1 — Pod without env label (should be blocked) Create a Pod in the monitoring namespace without the env label and without the team label. This Pod matches the match criteria and is not excluded, so the policy should deny it. Attempt to create the Pod:

kubectl run my-pod --image=nginx -n monitoring --restart=Never

Example denial from Kyverno webhook:

Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Pod/monitoring/my-pod was blocked due to the following policies
require-env-label:
  check-env-label: 'validation error: Pods in the monitoring namespace (except team=operations)
  must have the ''env'' label. rule check-env-label failed at path /metadata/labels/env/'

Test 2 — Pod with wrong label name (should also be blocked) If you accidentally add the wrong label key (for example teams=operations instead of team=operations), the Pod will still be evaluated by the policy and denied:

kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=teams=operations

Expected response (same denial as above):

Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Pod/monitoring/my-pod was blocked due to the following policies
require-env-label:
  check-env-label: 'validation error: Pods in the monitoring namespace (except team=operations)
  must have the ''env'' label. rule check-env-label failed at path /metadata/labels/env/'

Test 3 — Pod with team=operations (should be allowed) Now create the Pod with the correct excluding label key team=operations. Because the exclude selector matches this Pod, the policy will not be applied to it and creation should succeed even though it lacks the env label.

kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=team=operations

Expected response:

pod/my-pod created

You can confirm the Pod exists:

kubectl get pods -n monitoring

Summary

match narrows policy scope to specific resources (here: Pods in the monitoring namespace).
exclude defines exceptions so matched resources with certain labels are skipped (here: team=operations).
A Pod that matches match and is not excluded is validated by the validate rule and rejected if it doesn’t meet the pattern.
Label keys must be exact — typos like teams vs team will prevent exclusion and cause the policy to apply.

Use kubectl run ... --restart=Never to create an actual Pod (rather than a Deployment) for these tests. Also double-check label key names to ensure exclusions work as expected.

Links and References

Demo Exclude Statements

Watch Video

Practice Lab