Demo Patterns Anchors

This lesson demonstrates how to use anchors in Kyverno validate rules. Anchors let you express if-then style logic directly inside a policy pattern, making validation concise and declarative. We’ll cover three anchor types with short policy examples and test Pods:

Conditional anchors
Equality anchors
Existence anchors

Anchors are a Kyverno pattern feature that let you express conditional validation without adding an extra configuration block. failureAction: Enforce blocks resource creation when validation fails.

Quick reference: anchor types

Anchor type	Purpose	When to use
Conditional anchors `( )`	Express an if-then relationship where the path inside parentheses is the “if” and a sibling field is the “then”.	When a specific object or property implies another requirement.
Equality anchors `=`	Assert that an object exists and then apply constraints to its children.	When the mere presence of an object should constrain its fields.
Existence anchors (list matching)	Require at least one element in a list to match a pattern.	When you need one list element (e.g., a container) to meet a condition.

For full Kyverno anchor pattern syntax and examples, see the Kyverno documentation: https://kyverno.io/docs/writing-policies/validation-patterns/

1) Conditional anchors

Conditional anchors implement an if-then rule. The content inside parentheses is the “if” clause; a sibling key at the same hierarchy level is the “then” clause. Policy intent:

If a Pod mounts /var/run/docker.sock via a hostPath volume, then the Pod must include label allow-docker=true.
failureAction: Enforce blocks non-compliant Pods.

Policy (ClusterPolicy):

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: conditional-anchor-dockersock
spec:
  background: false
  rules:
    - name: disallow-dockersock-without-label
      match:
        resources:
          kinds:
            - Pod
      validate:
        failureAction: Enforce
        message: "If a Pod mounts /var/run/docker.sock via hostPath, it must have label allow-docker=true."
        pattern:
          (spec):
            (volumes):
              - (hostPath):
                  path: "/var/run/docker.sock"
          metadata:
            labels:
              allow-docker: "true"

How it works:

The (spec) -> (volumes) -> (hostPath) path is the “if” condition — it matches when a hostPath volume with path: /var/run/docker.sock is present.
The sibling metadata.labels.allow-docker is the “then” clause and must match true (string).

Apply the policy:

kubectl apply -f conditional-anchor-dockersock.yaml
# output
# clusterpolicy.kyverno.io/conditional-anchor-dockersock created

Compliant Pod (has required label):

apiVersion: v1
kind: Pod
metadata:
  name: good-pod
  labels:
    allow-docker: "true"
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: docker
      hostPath:
        path: /var/run/docker.sock

Create it:

kubectl apply -f good-pod.yaml
# output
# pod/good-pod created

Non-compliant Pod (missing label):

apiVersion: v1
kind: Pod
metadata:
  name: bad-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: docker
      hostPath:
        path: /var/run/docker.sock

Attempt to create it:

kubectl apply -f bad-pod.yaml
# output (admission webhook denies the request)
# Error from server: admission webhook "validate.kyverno.svc" denied the request: [conditional-anchor-dockersock] validation error: If a Pod mounts /var/run/docker.sock via hostPath, it must have label allow-docker=true.

Because the “if” condition matched and the required label was missing, admission is denied.

Policies with failureAction: Enforce will block resource creation on non-compliance. Use background and failureAction carefully in production clusters.

2) Equality anchors

Equality anchors use = to indicate the existence of an object. If the object exists, equality anchors let you place constraints on its child fields. Policy intent:

If a hostPath volume object exists in a Pod, then its path must not be /var/run/docker.sock.

Policy (ClusterPolicy):

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: equality-anchor-no-dockersock
spec:
  background: false
  rules:
    - name: equality-anchor-no-dockersock
      match:
        resources:
          kinds:
            - Pod
      validate:
        failureAction: Enforce
        message: "If a hostPath volume exists, it must not be set to `/var/run/docker.sock`."
        pattern:
          =(spec):
            =(volumes):
              - =(hostPath):
                  path: "!/var/run/docker.sock"

How it works:

=(spec) and =(volumes) assert that those objects exist; when they do, the child constraint applies.
path: "!/var/run/docker.sock" uses Kyverno’s ! operator to express “not equal”.

Apply the policy:

kubectl apply -f equality-anchors.yaml
# output
# clusterpolicy.kyverno.io/equality-anchor-no-dockersock created

Non-compliant Pod (disallowed hostPath path):

apiVersion: v1
kind: Pod
metadata:
  name: bad-dockersock-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: docker
      hostPath:
        path: /var/run/docker.sock

Attempt to create it:

kubectl apply -f bad-dockersock-pod.yaml
# output
# Error from server: admission webhook "validate.kyverno.svc" denied the request: [equality-anchor-no-dockersock] validation error: If a hostPath volume exists, it must not be set to `/var/run/docker.sock`.

Compliant Pod (different hostPath path):

apiVersion: v1
kind: Pod
metadata:
  name: good-dockersock-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: somepath
      hostPath:
        path: /var/run/some-other.sock

Create it:

kubectl apply -f good-dockersock-pod.yaml
# output
# pod/good-dockersock-pod created

Because the hostPath existed but its path did not match the forbidden value, the Pod passed validation.

3) Existence anchors

Existence anchors are applied to lists/arrays and assert that at least one element in the list matches a given pattern. This is ideal for requiring a Pod to include a specific sidecar or container image. Policy intent:

Verify that at least one container in the Pod uses the nginx image.

Behavior:

The policy iterates the containers list and accepts the Pod if any item has image: nginx. If none match, validation fails.

Apply the existence-anchor policy (example policy file assumed applied):

kubectl apply -f existence-anchor-nginx.yaml
# output
# clusterpolicy.kyverno.io/existence-anchor-nginx created

Non-compliant Pod (no nginx container):

apiVersion: v1
kind: Pod
metadata:
  name: busybox-only
spec:
  containers:
    - name: busy
      image: busybox
      command: ["sleep", "3600"]

Attempt to create it:

kubectl apply -f busybox-only.yaml
# output
# Error from server: admission webhook "validate.kyverno.svc" denied the request: [existence-anchor-nginx] validation error: at least one container must use image 'nginx'

Compliant Pod (has an nginx container among others):

apiVersion: v1
kind: Pod
metadata:
  name: multi-container-with-nginx
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
    - name: proxy
      image: nginx

Create it:

kubectl apply -f multi-container-with-nginx.yaml
# output
# pod/multi-container-with-nginx created

Because one of the containers matches the required pattern (image: nginx), the policy is satisfied.

Recap

Conditional anchors ( ) create if-then rules where the “if” is an object pattern and the “then” is a sibling field.
Equality anchors = check for the existence of an object and impose constraints on its children.
Existence anchors operate on lists and require at least one element to match the provided pattern.

These anchors let you write compact, declarative Kyverno validate patterns for common policy intents without adding extra configuration blocks.

Links and references

Kyverno validation patterns: https://kyverno.io/docs/writing-policies/validation-patterns/
Kyverno GitHub: https://github.com/kyverno/kyverno
Kubernetes documentation: https://kubernetes.io/docs/

Demo Patterns Anchors

Quick reference: anchor types

1) Conditional anchors

2) Equality anchors

3) Existence anchors

Recap

Links and references

Watch Video

Practice Lab

​Quick reference: anchor types

​1) Conditional anchors

​2) Equality anchors

​3) Existence anchors

​Recap

​Links and references

Watch Video

Practice Lab

Quick reference: anchor types

1) Conditional anchors

2) Equality anchors

3) Existence anchors

Recap

Links and references