> ## Documentation Index
> Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Demo Patterns Anchors

> Explains Kyverno validation anchors with conditional, equality, and existence examples to enforce Pod policies such as hostPath restrictions and required container images.

This lesson demonstrates how to use anchors in Kyverno validate rules. Anchors let you express if-then style logic directly inside a policy `pattern`, making validation concise and declarative. We'll cover three anchor types with short policy examples and test Pods:

* Conditional anchors
* Equality anchors
* Existence anchors

<Callout icon="lightbulb" color="#1CB2FE">
  Anchors are a Kyverno pattern feature that let you express conditional validation without adding an extra configuration block. `failureAction: Enforce` blocks resource creation when validation fails.
</Callout>

***

## Quick reference: anchor types

| Anchor type                       | Purpose                                                                                                          | When to use                                                             |
| --------------------------------- | ---------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
| Conditional anchors `( )`         | Express an if-then relationship where the path inside parentheses is the "if" and a sibling field is the "then". | When a specific object or property implies another requirement.         |
| Equality anchors `=`              | Assert that an object exists and then apply constraints to its children.                                         | When the mere presence of an object should constrain its fields.        |
| Existence anchors (list matching) | Require at least one element in a list to match a pattern.                                                       | When you need one list element (e.g., a container) to meet a condition. |

For full Kyverno anchor pattern syntax and examples, see the Kyverno documentation: [https://kyverno.io/docs/writing-policies/validation-patterns/](https://kyverno.io/docs/writing-policies/validation-patterns/)

***

## 1) Conditional anchors

Conditional anchors implement an if-then rule. The content inside parentheses is the "if" clause; a sibling key at the same hierarchy level is the "then" clause.

Policy intent:

* If a Pod mounts `/var/run/docker.sock` via a `hostPath` volume, then the Pod must include label `allow-docker=true`.
* `failureAction: Enforce` blocks non-compliant Pods.

Policy (ClusterPolicy):

```yaml theme={null}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: conditional-anchor-dockersock
spec:
  background: false
  rules:
    - name: disallow-dockersock-without-label
      match:
        resources:
          kinds:
            - Pod
      validate:
        failureAction: Enforce
        message: "If a Pod mounts /var/run/docker.sock via hostPath, it must have label allow-docker=true."
        pattern:
          (spec):
            (volumes):
              - (hostPath):
                  path: "/var/run/docker.sock"
          metadata:
            labels:
              allow-docker: "true"
```

How it works:

* The `(spec) -> (volumes) -> (hostPath)` path is the "if" condition — it matches when a `hostPath` volume with `path: /var/run/docker.sock` is present.
* The sibling `metadata.labels.allow-docker` is the "then" clause and must match `true` (string).

Apply the policy:

```bash theme={null}
kubectl apply -f conditional-anchor-dockersock.yaml
# output
# clusterpolicy.kyverno.io/conditional-anchor-dockersock created
```

Compliant Pod (has required label):

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: good-pod
  labels:
    allow-docker: "true"
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: docker
      hostPath:
        path: /var/run/docker.sock
```

Create it:

```bash theme={null}
kubectl apply -f good-pod.yaml
# output
# pod/good-pod created
```

Non-compliant Pod (missing label):

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: bad-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: docker
      hostPath:
        path: /var/run/docker.sock
```

Attempt to create it:

```bash theme={null}
kubectl apply -f bad-pod.yaml
# output (admission webhook denies the request)
# Error from server: admission webhook "validate.kyverno.svc" denied the request: [conditional-anchor-dockersock] validation error: If a Pod mounts /var/run/docker.sock via hostPath, it must have label allow-docker=true.
```

Because the "if" condition matched and the required label was missing, admission is denied.

<Callout icon="warning" color="#FF6B6B">
  Policies with `failureAction: Enforce` will block resource creation on non-compliance. Use `background` and `failureAction` carefully in production clusters.
</Callout>

***

## 2) Equality anchors

Equality anchors use `=` to indicate the existence of an object. If the object exists, equality anchors let you place constraints on its child fields.

Policy intent:

* If a `hostPath` volume object exists in a Pod, then its `path` must not be `/var/run/docker.sock`.

Policy (ClusterPolicy):

```yaml theme={null}
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: equality-anchor-no-dockersock
spec:
  background: false
  rules:
    - name: equality-anchor-no-dockersock
      match:
        resources:
          kinds:
            - Pod
      validate:
        failureAction: Enforce
        message: "If a hostPath volume exists, it must not be set to `/var/run/docker.sock`."
        pattern:
          =(spec):
            =(volumes):
              - =(hostPath):
                  path: "!/var/run/docker.sock"
```

How it works:

* `=(spec)` and `=(volumes)` assert that those objects exist; when they do, the child constraint applies.
* `path: "!/var/run/docker.sock"` uses Kyverno's `!` operator to express "not equal".

Apply the policy:

```bash theme={null}
kubectl apply -f equality-anchors.yaml
# output
# clusterpolicy.kyverno.io/equality-anchor-no-dockersock created
```

Non-compliant Pod (disallowed hostPath path):

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: bad-dockersock-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: docker
      hostPath:
        path: /var/run/docker.sock
```

Attempt to create it:

```bash theme={null}
kubectl apply -f bad-dockersock-pod.yaml
# output
# Error from server: admission webhook "validate.kyverno.svc" denied the request: [equality-anchor-no-dockersock] validation error: If a hostPath volume exists, it must not be set to `/var/run/docker.sock`.
```

Compliant Pod (different hostPath path):

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: good-dockersock-pod
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
  volumes:
    - name: somepath
      hostPath:
        path: /var/run/some-other.sock
```

Create it:

```bash theme={null}
kubectl apply -f good-dockersock-pod.yaml
# output
# pod/good-dockersock-pod created
```

Because the `hostPath` existed but its `path` did not match the forbidden value, the Pod passed validation.

***

## 3) Existence anchors

Existence anchors are applied to lists/arrays and assert that at least one element in the list matches a given pattern. This is ideal for requiring a Pod to include a specific sidecar or container image.

Policy intent:

* Verify that at least one container in the Pod uses the `nginx` image.

Behavior:

* The policy iterates the `containers` list and accepts the Pod if any item has `image: nginx`. If none match, validation fails.

Apply the existence-anchor policy (example policy file assumed applied):

```bash theme={null}
kubectl apply -f existence-anchor-nginx.yaml
# output
# clusterpolicy.kyverno.io/existence-anchor-nginx created
```

Non-compliant Pod (no nginx container):

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: busybox-only
spec:
  containers:
    - name: busy
      image: busybox
      command: ["sleep", "3600"]
```

Attempt to create it:

```bash theme={null}
kubectl apply -f busybox-only.yaml
# output
# Error from server: admission webhook "validate.kyverno.svc" denied the request: [existence-anchor-nginx] validation error: at least one container must use image 'nginx'
```

Compliant Pod (has an nginx container among others):

```yaml theme={null}
apiVersion: v1
kind: Pod
metadata:
  name: multi-container-with-nginx
spec:
  containers:
    - name: app
      image: busybox
      command: ["sleep", "3600"]
    - name: proxy
      image: nginx
```

Create it:

```bash theme={null}
kubectl apply -f multi-container-with-nginx.yaml
# output
# pod/multi-container-with-nginx created
```

Because one of the containers matches the required pattern (`image: nginx`), the policy is satisfied.

***

## Recap

* Conditional anchors `( )` create if-then rules where the "if" is an object pattern and the "then" is a sibling field.
* Equality anchors `=` check for the existence of an object and impose constraints on its children.
* Existence anchors operate on lists and require at least one element to match the provided pattern.

These anchors let you write compact, declarative Kyverno validate patterns for common policy intents without adding extra configuration blocks.

## Links and references

* Kyverno validation patterns: [https://kyverno.io/docs/writing-policies/validation-patterns/](https://kyverno.io/docs/writing-policies/validation-patterns/)
* Kyverno GitHub: [https://github.com/kyverno/kyverno](https://github.com/kyverno/kyverno)
* Kubernetes documentation: [https://kubernetes.io/docs/](https://kubernetes.io/docs/)

<CardGroup>
  <Card title="Watch Video" icon="video" cta="Learn more" href="https://learn.kodekloud.com/user/courses/kyverno-certified-associate/module/f5dd3064-bb37-41e2-8092-362f4cd56c57/lesson/7e0be25b-ff0d-451f-86c3-c509bdc4a075" />

  <Card title="Practice Lab" icon="flask-conical" cta="Learn more" href="https://learn.kodekloud.com/user/courses/kyverno-certified-associate/module/f5dd3064-bb37-41e2-8092-362f4cd56c57/lesson/a0161669-b400-4a56-be96-9830372afa74" />
</CardGroup>