Demo Match Statements

This guide demonstrates how Kyverno match blocks control which resources a policy evaluates. We’ll enforce that Pods and Deployments include a non-empty env label using a ClusterPolicy, then refine the rule to target a specific namespace.

Policy: require an `env` label

Create the following ClusterPolicy to validate that metadata.labels.env exists and is non-empty for Pods and Deployments:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-label-env
spec:
  validationFailureAction: enforce
  rules:
    - name: check-label-env
      match:
        any:
          - resources:
              kinds:
                - Pod
                - Deployment
      validate:
        message: "The label `env` is required."
        pattern:
          metadata:
            labels:
              env: "?*"

The key parts:

match selects which resources Kyverno evaluates (here: kinds Pod and Deployment).
validate.pattern enforces the presence and a non-empty value for metadata.labels.env.

The ?* pattern in Kyverno matches any non-empty string, ensuring the env label exists and is not empty.

This policy uses validationFailureAction: enforce, which will block resource creation or updates that don’t meet the rule. Use audit if you prefer non-blocking checks.

Apply the policy

Apply the policy manifest and verify the ClusterPolicy is ready:

kubectl apply -f check-label.yaml
kubectl get cpol check-label-env
# NAME              ADMISSION   BACKGROUND   READY   AGE    MESSAGE
# check-label-env   true        true         true    10s    Ready

Test the policy

Create a Pod without labels (expected: rejected, because Pod is matched by the rule):

kubectl run my-pod --image=nginx

Example admission webhook response:

Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Pod/default/my-pod was blocked due to the following policies

check-label-env:
  check-label-env: validation error: The label `env` is required. rule check-label-env

Create a Deployment without the env label (expected: rejected):

kubectl create deployment my-deployment --image=nginx

Example error:

error: failed to create deployment: admission webhook "validate.kyverno.svc" denied the request:
resource Deployment/default/my-deployment was blocked due to the following policies

check-label-env:
  check-label-env: validation error: The label `env` is required. rule check-label-env failed at path /metadata/labels/env/

Create a Pod with the env label (expected: allowed):

kubectl run my-pod --image=nginx --labels=env=dev
# pod/my-pod created

These steps confirm the policy enforces the env label for the matched kinds.

Scope the rule to a namespace

You can narrow the match block to specific namespaces. The example below restricts enforcement to the restricted-ns namespace:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: check-label-env
spec:
  validationFailureAction: enforce
  rules:
    - name: check-label-env
      match:
        any:
          - resources:
              kinds:
                - Pod
                - Deployment
              namespaces:
                - restricted-ns
      validate:
        message: "The label `env` is required."
        pattern:
          metadata:
            labels:
              env: "?*"

Apply the updated policy and create the namespace:

kubectl apply -f check-label.yaml
kubectl create namespace restricted-ns
# namespace/restricted-ns created

Test the namespace-scoped behavior:

Create a Pod in restricted-ns without labels (expected: rejected):

kubectl run my-pod --image=nginx -n restricted-ns

Example webhook response:

Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Pod/restricted-ns/my-pod was blocked due to the following policies

check-label-env:
  check-label-env: validation error: The label `env` is required. rule check-label-env failed at path /metadata/labels/env/

Create a Pod in the default namespace without labels (expected: allowed, because it doesn’t match the namespaces filter):

kubectl run test-pod --image=nginx
# pod/test-pod created

Quick reference

Topic	Behavior	Example command
Match by kind	Targets resources by kind (Pod, Deployment)	`match: resources.kinds: - Pod - Deployment`
Match by namespace	Further restricts scope to specific namespaces	`namespaces: - restricted-ns`
Validation pattern	Enforces non-empty `env` label	`metadata.labels.env: "?*"`
Apply policy	Install or update ClusterPolicy	`kubectl apply -f check-label.yaml`

Summary

Use the match block to control which resources Kyverno evaluates (kinds, namespaces, selectors).
Use validate.pattern to require fields—?* ensures a string is present and non-empty.
Adding namespaces to match scopes enforcement to specific namespaces (e.g., restricted-ns) while leaving other namespaces unaffected.

Demo Match Statements

Policy: require an `env` label

Apply the policy

Test the policy

Scope the rule to a namespace

Quick reference

Summary

Links and references

Watch Video

Practice Lab

​Policy: require an env label

​Apply the policy

​Test the policy

​Scope the rule to a namespace

​Quick reference

​Summary

​Links and references

Watch Video

Practice Lab

Policy: require an `env` label

Apply the policy

Test the policy

Scope the rule to a namespace

Quick reference

Summary

Links and references