Skip to main content
Patterns in Kyverno can match exact values or use operator expressions to perform comparisons and logical tests. Operator expressions are written as quoted strings inside a pattern block, letting you enforce numeric ranges, negations, and combined conditions without writing custom code.

​
How operator strings work

  • Write the operator and the comparison value together as a quoted string (for example, "<=3" or "!default").
  • Kyverno detects operators at the start of the string and performs the appropriate comparison (it does not do plain string comparisons).
  • Equality is the default: provide a raw value (for example, replicas: 3) to test for equality.
Always enclose operator expressions in quotes so Kyverno treats them as operator strings (for example, ">=2" or "!default"). Unquoted values will be treated as plain values, not operator expressions.

​
Common operators (quick reference)

The image illustrates four types of common operators: equality, numeric comparison, logical (for combining conditions), and ranges, each with corresponding symbols.
The hyphen (-) denotes a range check. Prepending ! negates the range, testing that values fall outside it.

​
Examples

Below are two practical policies showing how to apply operator expressions in Kyverno pattern blocks. Example 1 — Enforce minimum replicas (numeric comparison) Alex needs a high-availability policy so Deployments must have at least two replicas. This policy matches Deployments and validates that spec.replicas is greater than or equal to 2.
Behavior: a Deployment with replicas: 1 fails because 1 >= 2 is false. Values 2 or higher pass validation. Example 2 — Prevent use of the default namespace (not-equals) Alice wants to block developers from creating Pods or Deployments in the default namespace. Since the API server will default an omitted metadata.namespace to default before Kyverno evaluates the resource, checking metadata.namespace is sufficient.
Behavior: Resources with metadata.namespace: default (or with the field omitted) fail validation; other namespaces pass.
When testing operator strings, remember equality is the default: provide the value directly to test equality (for example, replicas: 3). Use quoted operator strings for comparisons, ranges, and negations (for example, ">=2" or "!default").

​
Additional tips

  • Use logical operators (& and |) to combine multiple checks within a single string when appropriate.
  • Prefer explicit checks for fields that the API server might default (like metadata.namespace) to avoid surprises.
  • Test policies in a non-production cluster to verify behavior before enforcing in production.

Watch Video