Demo Preconditions

In this lesson we use Kyverno preconditions to make a ClusterPolicy that only runs against Services of type NodePort. When the precondition is met, the policy validates that spec.externalTrafficPolicy is set to Local.

The image features the words "Preconditions" and "Demo" on a white and blue-green background, with a copyright notice for KodeKloud.

Goal

Validate Services only when spec.type is NodePort.
Enforce spec.externalTrafficPolicy: Local for those NodePort Services.

Preconditions are evaluated against the incoming admission request. If preconditions pass, the rule’s validate/mutate/generate actions run; otherwise the rule is skipped. Use preconditions to make policies highly selective and avoid unnecessary validation on unrelated resources.

Policy manifest (ClusterPolicy)

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: validate-nodeport-trafficpolicy
spec:
  rules:
    - name: validate-nodeport-trafficpolicy
      match:
        any:
          - resources:
              kinds:
                - Service
      preconditions:
        all:
          - key: "{{ request.object.spec.type }}"
            operator: Equals
            value: NodePort
      validationFailureAction: enforce
      validate:
        message: "All NodePort Services must use an externalTrafficPolicy of Local."
        pattern:
          spec:
            externalTrafficPolicy: Local

What this policy does

match narrows targets to Kubernetes Service resources.
preconditions further limit execution to Services whose spec.type equals NodePort.
When the precondition passes, the validate block enforces that spec.externalTrafficPolicy is Local.
If the precondition does not pass (for example, a ClusterIP Service), the rule is skipped.

Apply the policy

kubectl apply -f validate-nodeport-trafficpolicy.yaml

Verify the ClusterPolicy is ready

kubectl get cpol validate-nodeport-trafficpolicy

Example output:

NAME                             ADMISSION   BACKGROUND   READY   AGE
validate-nodeport-trafficpolicy  true        true         Ready   10s

Test cases We create three Service examples to demonstrate the policy behavior:

Test case	Service type	externalTrafficPolicy	Expected outcome
Bad NodePort	`NodePort`	`Cluster`	Blocked by Kyverno; validation fails
Good NodePort	`NodePort`	`Local`	Created successfully
ClusterIP	`ClusterIP`	n/a	Policy precondition fails → Rule skipped; created successfully

Bad NodePort Service (should be rejected)

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: bad-nodeport-service
spec:
  type: NodePort
  selector:
    app: bad-app
  ports:
    - port: 80
      targetPort: 8080
  externalTrafficPolicy: Cluster
EOF

Expected admission webhook error:

Error from server: error when creating "STDIN": admission webhook "validate.kyverno.svc-fail" denied the request:
resource Service/default/bad-nodeport-service was blocked due to the following policies

validate-nodeport-trafficpolicy:
  validate-nodeport-trafficpolicy: 'validation error: All NodePort Services must use
    an externalTrafficPolicy of Local. rule validate-nodeport-trafficpolicy failed
    at path /spec/externalTrafficPolicy/'

The admission webhook will block creation when the policy’s validationFailureAction is enforce. Inspect Kyverno logs and events if an expected create is denied.

Good NodePort Service (should be accepted)

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: good-nodeport-service
spec:
  type: NodePort
  selector:
    app: good-app
  ports:
    - port: 80
      targetPort: 8080
  externalTrafficPolicy: Local
EOF

Expected response:

service/good-nodeport-service created

ClusterIP Service (precondition not met; policy skipped — should be accepted)

cat <<EOF | kubectl apply -f -
apiVersion: v1
kind: Service
metadata:
  name: clusterip-service
spec:
  type: ClusterIP
  selector:
    app: clusterip-app
  ports:
    - port: 80
      targetPort: 8080
EOF

Expected response:

service/clusterip-service created

Summary and references

Use match to restrict resources to specific kinds (here: Service).
Use preconditions to further filter requests before running policy logic.
The validate block runs only when preconditions succeed; otherwise the rule is skipped.
For more details, see the Kyverno documentation:
- Kyverno documentation: https://kyverno.io/docs/
- Kubernetes Services: https://kubernetes.io/docs/concepts/services-networking/service/

Demo Preconditions

Watch Video

Practice Lab