> ## Documentation Index > Fetch the complete documentation index at: https://notes.kodekloud.com/llms.txt > Use this file to discover all available pages before exploring further. # Demo Patterns Operators > Explains using Kyverno pattern operators to enforce minimum Deployment replicas and forbid the default namespace via validation ClusterPolicies In this lesson you'll learn how to use operators in Kyverno validate rules. We'll walk through two practical ClusterPolicy examples: * Enforce a minimum replica count for Deployments using comparison operators. * Block Deployments created in the `default` namespace using the not (`!`) operator. These examples use Kyverno `pattern`-based validation to express flexible constraints without hardcoding exact values. *** ## 1) Enforce minimum replica count This ClusterPolicy validates Deployments and enforces that `spec.replicas` is greater than or equal to 2. The comparison operator is expressed as a string inside the `pattern` field. ```yaml theme={null} # policy-1.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: validate-replica-count spec: rules: - name: validate-replica-count match: any: resources: kinds: - Deployment validate: failureAction: Enforce message: "Replica count for a Deployment must be greater than or equal to 2." pattern: spec: replicas: ">=2" ``` Key points: * `failureAction: Enforce` blocks resources that don't meet the policy. * `pattern.spec.replicas: ">=2"` lets Kyverno accept any numeric value >= 2 (no exact value required). If you match on `replicas`, Kyverno may warn about the `scale` subresource not being included in the policy. This is informational only and doesn't change validation behavior, but add `subresources` to your `match` block if you also want to handle scale subresource requests. When using numeric operators in Kyverno `pattern` values, put the operator and the number in a string (for example `">=2"`). This enables comparison-style validation in patterns. Apply the policy: ```bash theme={null} kubectl apply -f policy-1.yaml ``` Expected output: ```plaintext theme={null} Warning: You are matching on replicas but not including the scale subresource in the policy. clusterpolicy.kyverno.io/validate-replica-count created ``` Try creating a Deployment that violates the policy (replicas = 1): ```bash theme={null} kubectl create deployment bad-deployment --image=nginx --replicas=1 ``` Expected admission error: ```plaintext theme={null} error: failed to create deployment: admission webhook "validate.kyverno.svc-fail" denied the request: resource Deployment/default/bad-deployment was blocked due to the following policies validate-replica-count: 'validation' error: Replica count for a Deployment must be greater than or equal to 2. rule validate-replica-count failed at path /spec/replicas/ ``` Now create a compliant Deployment (replicas = 3): ```bash theme={null} kubectl create deployment good-deployment --image=nginx --replicas=3 ``` Expected output: ```plaintext theme={null} deployment.apps/good-deployment created ``` This demonstrates how Kyverno's comparison operators allow enforcing minimum replica counts without requiring fixed replica values. *** ## 2) Disallow using the default namespace This ClusterPolicy prevents Deployments from being created in the `default` namespace. It uses the not operator (`!`) in the `pattern` value to assert that `metadata.namespace` must not equal `default`. ```yaml theme={null} # policy-2.yaml apiVersion: kyverno.io/v1 kind: ClusterPolicy metadata: name: disallow-default-namespace spec: rules: - name: disallow-default-namespace match: any: resources: kinds: - Deployment validate: failureAction: Enforce message: > Using the 'default' namespace is not allowed. pattern: metadata: # This value asserts that metadata.namespace is NOT "default". namespace: "!default" ``` Notes: * `pattern.metadata.namespace: "!default"` asserts that the namespace value must not be `default`. * `failureAction: Enforce` blocks requests that attempt to create Deployments in the `default` namespace. Apply the policy: ```bash theme={null} kubectl apply -f policy-2.yaml ``` Expected output: ```plaintext theme={null} clusterpolicy.kyverno.io/disallow-default-namespace created ``` If you try to create a Deployment without specifying a namespace (which defaults to `default`), it will be rejected: ```bash theme={null} kubectl create deployment bad-deployment --image=nginx --replicas=1 ``` Expected admission error: ```plaintext theme={null} error: failed to create deployment: admission webhook "validate.kyverno.svc-fail" denied the request: resource Deployment/default/bad-deployment was blocked due to the following policies disallow-default-namespace: 'validation' error: Using the 'default' namespace is not allowed. rule disallow-default-namespace failed at path /metadata/namespace/ ``` To comply with the policy, create a different namespace and deploy there: ```bash theme={null} kubectl create ns my-apps kubectl create deployment bad-deployment --image=nginx --replicas=1 -n my-apps ``` Expected output: ```plaintext theme={null} namespace/my-apps created deployment.apps/bad-deployment created ``` Using the `-n` flag or specifying `metadata.namespace` in manifests ensures resources are placed into allowed namespaces. *** ## Summary This lesson demonstrated two ways to use operators inside Kyverno `pattern` validations: | Use case | Operator example | Behavior | | --------------------------- | ---------------- | ------------------------------------------------------------- | | Enforce minimum replicas | `">=2"` | Accepts any numeric replicas value greater than or equal to 2 | | Disallow specific namespace | `"!default"` | Rejects resources whose `metadata.namespace` equals `default` | These pattern operators let you express flexible, readable validation rules without hardcoding exact values. Use comparison operators for numeric constraints and the not operator (`!`) to exclude specific values. ## Links and References * Kyverno Documentation: [https://kyverno.io/](https://kyverno.io/) * Kyverno Policy Examples: [https://kyverno.io/docs/writing-policies/](https://kyverno.io/docs/writing-policies/) * Kubernetes Concepts — Namespaces: [https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/](https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/)