Basic Validations - KodeKloud

In this lesson, you’ll learn the most common and fundamental way to validate resources in Kyverno: using a pattern-based validate rule. Meet Alex, a platform engineer with a simple but important requirement: he must ensure every new Namespace in the cluster is labeled with its intended purpose so cost allocation and governance remain accurate.

The image outlines a goal related to enforcing namespace labels to ensure cost allocation and governance, requiring a label 'purpose' with the value 'production' for new namespaces. It features a character named Alex along with a quotation explaining the goal.

Goal: enforce that every newly created Namespace must include a label purpose: production. This prevents accidental or untracked Namespace creation and is an ideal use case for a Kyverno validate rule. Below we build a cluster-scoped policy step-by-step to enforce this requirement.

ClusterPolicy: require-ns-purpose-label

We use ClusterPolicy because the rule must apply to all Namespaces regardless of where they are created.

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-ns-purpose-label
spec:
  rules:
  - name: require-ns-purpose-label
    # The `match` block sets the scope. We are targeting any resource of kind "Namespace".
    match:
      any:
      - resources:
          kinds:
          - Namespace

    # The `validate` block defines the check that must pass for matched resources.
    validate:
      message: "Validation error: You must have label `purpose` with value `production` set on all new namespaces."
      pattern:
        metadata:
          labels:
            purpose: production

What each section does:

Field	Purpose	Example / Notes
`kind: ClusterPolicy`	Makes the policy cluster-scoped so it applies to all namespaces	Use `Policy` for a namespaced policy instead
`match.resources.kinds`	Targets resources this rule applies to	`Namespace` ensures only Namespace creations are validated
`validate.message`	Custom error text shown to users when validation fails	Helps guide users to fix the request
`validate.pattern`	The expected structure/values the incoming resource must match	Here: `metadata.labels.purpose: production`

How the pattern works

Kyverno compares the incoming Namespace resource to the pattern.
If the pattern is present and matches (exact purpose: production), Kyverno allows the request.
If the pattern is missing, the label value differs, or the labels block is absent, Kyverno rejects the request with the provided message.

Compliant example

A Namespace manifest that satisfies the policy:

apiVersion: v1
kind: Namespace
metadata:
  name: good-namespace
  labels:
    purpose: production

Kyverno will find metadata.labels.purpose: production and allow the Namespace creation.

Non-compliant example

A Namespace manifest that fails validation:

apiVersion: v1
kind: Namespace
metadata:
  name: bad-namespace
  labels:
    purpose: development

Because purpose is development (not production), Kyverno will block the request.

If validation fails, users receive immediate feedback when they run kubectl apply, preventing misconfigurations before resources are created.

Example kubectl failure output for the non-compliant manifest:

$ kubectl apply -f bad-namespace.yaml
Error from server: admission webhook "validate.kyverno.svc" denied the request:
resource Namespace/bad-namespace was blocked due to the following policies
require-ns-purpose-label:
require-ns-purpose-label: 'Validation error: You must have label `purpose` with value `production` set on all new namespaces.'

The error identifies the admission webhook, the blocked resource, the policy that triggered it, and the custom message — giving the user a clear action to resolve the failure.

Watch Video

Section Introduction

Failure Action

​ClusterPolicy: require-ns-purpose-label

​How the pattern works

​Compliant example

​Non-compliant example

​Further reading

Watch Video

ClusterPolicy: require-ns-purpose-label

How the pattern works

Compliant example

Non-compliant example

Further reading