> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Demo Exclude Statements
> Demonstrates a Kyverno ClusterPolicy that requires Pods in the monitoring namespace to have an env label while excluding Pods labeled team=operations
This lesson shows how to combine `match` and `exclude` statements in a Kyverno policy to enforce labels selectively.
Goal
* Require a Pod to have an `env` label when it is created in the `monitoring` namespace.
* Exempt Pods that have the `team=operations` label (those Pods are excluded from the policy).
Policy definition
Below is the ClusterPolicy that enforces this behavior. The `match` block narrows the policy scope to Pods in the `monitoring` namespace. The `exclude` block creates an exception for Pods with the `team: operations` label.
```yaml theme={null}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-env-label
spec:
rules:
- name: check-env-label
match:
resources:
kinds:
- Pod
namespaces:
- monitoring
exclude:
resources:
selector:
matchLabels:
team: operations
validate:
failureAction: Enforce
message: "Pods in the monitoring namespace (except team=operations) must have the 'env' label."
pattern:
metadata:
labels:
env: "?*"
```
Apply the policy
Run the following to create the ClusterPolicy in your cluster:
```bash theme={null}
cat <<'EOF' | kubectl apply -f -
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
name: require-env-label
spec:
rules:
- name: check-env-label
match:
resources:
kinds:
- Pod
namespaces:
- monitoring
exclude:
resources:
selector:
matchLabels:
team: operations
validate:
failureAction: Enforce
message: "Pods in the monitoring namespace (except team=operations) must have the 'env' label."
pattern:
metadata:
labels:
env: "?*"
EOF
```
Expected response:
```text theme={null}
clusterpolicy.kyverno.io/require-env-label created
```
Verify the policy:
```bash theme={null}
kubectl get cpol require-env-label
```
Example output:
```text theme={null}
NAME ADMISSION BACKGROUND READY AGE MESSAGE
require-env-label true true True 10s Ready
```
Create the `monitoring` namespace (if it doesn't exist):
```bash theme={null}
kubectl create namespace monitoring
```
Expected response:
```text theme={null}
namespace/monitoring created
```
Tests
Below are three tests demonstrating how `match` and `exclude` interact.
| Test | Command | Expected result |
| ------------------------------------------------------ | ------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------- |
| 1 — Pod without `env` label (should be blocked) | `kubectl run my-pod --image=nginx -n monitoring --restart=Never` | Denied by Kyverno validation webhook because the Pod matches `match` and is not excluded. |
| 2 — Pod with wrong label name (should also be blocked) | `kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=teams=operations` | Denied — label key must be `team`, so the Pod is not excluded. |
| 3 — Pod with `team=operations` (should be allowed) | `kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=team=operations` | Allowed — the `exclude` selector matches and the policy is not applied. |
Test 1 — Pod without `env` label (should be blocked)
Create a Pod in the `monitoring` namespace without the `env` label and without the `team` label. This Pod matches the `match` criteria and is not excluded, so the policy should deny it.
Attempt to create the Pod:
```bash theme={null}
kubectl run my-pod --image=nginx -n monitoring --restart=Never
```
Example denial from Kyverno webhook:
```text theme={null}
Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Pod/monitoring/my-pod was blocked due to the following policies
require-env-label:
check-env-label: 'validation error: Pods in the monitoring namespace (except team=operations)
must have the ''env'' label. rule check-env-label failed at path /metadata/labels/env/'
```
Test 2 — Pod with wrong label name (should also be blocked)
If you accidentally add the wrong label key (for example `teams=operations` instead of `team=operations`), the Pod will still be evaluated by the policy and denied:
```bash theme={null}
kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=teams=operations
```
Expected response (same denial as above):
```text theme={null}
Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Pod/monitoring/my-pod was blocked due to the following policies
require-env-label:
check-env-label: 'validation error: Pods in the monitoring namespace (except team=operations)
must have the ''env'' label. rule check-env-label failed at path /metadata/labels/env/'
```
Test 3 — Pod with `team=operations` (should be allowed)
Now create the Pod with the correct excluding label key `team=operations`. Because the `exclude` selector matches this Pod, the policy will not be applied to it and creation should succeed even though it lacks the `env` label.
```bash theme={null}
kubectl run my-pod --image=nginx -n monitoring --restart=Never --labels=team=operations
```
Expected response:
```text theme={null}
pod/my-pod created
```
You can confirm the Pod exists:
```bash theme={null}
kubectl get pods -n monitoring
```
Summary
* `match` narrows policy scope to specific resources (here: Pods in the `monitoring` namespace).
* `exclude` defines exceptions so matched resources with certain labels are skipped (here: `team=operations`).
* A Pod that matches `match` and is not excluded is validated by the `validate` rule and rejected if it doesn't meet the pattern.
* Label keys must be exact — typos like `teams` vs `team` will prevent exclusion and cause the policy to apply.
Use `kubectl run ... --restart=Never` to create an actual Pod (rather than a Deployment) for these tests. Also double-check label key names to ensure exclusions work as expected.
Links and References
* [Kyverno Documentation](https://kyverno.io/docs/)
* [kubectl reference](https://kubernetes.io/docs/reference/kubectl/overview/)