$ kubectl create ns policy-test
namespace/policy-test created
$ kubectl -n policy-test run naked --image=busybox:1.37 --restart=Never -- sleep 60   # succeeds: Audit
pod/naked created
$ kubectl get policyreports -n policy-test    # the violation is recorded instead
NAME                                   KIND   NAME    PASS   FAIL   WARN   ERROR   SKIP   AGE
f60c73a9-33c8-4479-8708-7cbc10ad5c62   Pod    naked   0      1      0      0       0      25s
$ kubectl patch validatingpolicy require-resource-requests --type=merge \
  -p '{"spec":{"validationActions":["Deny"]}}'
validatingpolicy.policies.kyverno.io/require-resource-requests patched
$ kubectl -n policy-test run naked2 --image=busybox:1.37 --restart=Never -- sleep 60
Error from server: admission webhook "vpol.validate.kyverno.svc-fail" denied the request: Policy require-resource-requests failed: every container must set cpu and memory requests

$ kubectl api-resources | grep -E 'kyverno'
cleanuppolicies                                cleanpol                               kyverno.io/v2                             true         CleanupPolicy
clustercleanuppolicies                         ccleanpol                              kyverno.io/v2                             false        ClusterCleanupPolicy
clusterpolicies                                cpol                                   kyverno.io/v1                             false        ClusterPolicy
globalcontextentries                           gctxentry                              kyverno.io/v2                             false        GlobalContextEntry
policies                                       pol                                    kyverno.io/v1                             true         Policy
policyexceptions                               polex                                  kyverno.io/v2                             true         PolicyException
updaterequests                                 ur                                     kyverno.io/v2                             true         UpdateRequest
deletingpolicies                               dpol                                   policies.kyverno.io/v1                    false        DeletingPolicy
generatingpolicies                             gpol                                   policies.kyverno.io/v1                    false        GeneratingPolicy
imagevalidatingpolicies                        ivpol                                  policies.kyverno.io/v1                    false        ImageValidatingPolicy
mutatingpolicies                               mpol                                   policies.kyverno.io/v1                    false        MutatingPolicy
namespaceddeletingpolicies                     ndpol                                  policies.kyverno.io/v1                    true         NamespacedDeletingPolicy
namespacedgeneratingpolicies                   ngpol                                  policies.kyverno.io/v1                    true         NamespacedGeneratingPolicy
namespacedimagevalidatingpolicies              nivpol                                 policies.kyverno.io/v1                    true         NamespacedImageValidatingPolicy
namespacedmutatingpolicies                     nmpol                                  policies.kyverno.io/v1                    true         NamespacedMutatingPolicy
namespacedvalidatingpolicies                   nvpol                                  policies.kyverno.io/v1                    true         NamespacedValidatingPolicy
policyexceptions                                                                      policies.kyverno.io/v1                    true         PolicyException
validatingpolicies                             vpol                                   policies.kyverno.io/v1                    false        ValidatingPolicy
clusterephemeralreports                        cephr                                  reports.kyverno.io/v1                     false        ClusterEphemeralReport
ephemeralreports                               ephr                                   reports.kyverno.io/v1                     true         EphemeralReport
$ kubectl -n kyverno get deploy -o jsonpath='{range .items[*]}{.metadata.name} {.spec.template.spec.containers[0].image}{"\n"}{end}'
kyverno-admission-controller reg.kyverno.io/kyverno/kyverno:v1.19.1
kyverno-background-controller reg.kyverno.io/kyverno/background-controller:v1.19.1
kyverno-cleanup-controller reg.kyverno.io/kyverno/cleanup-controller:v1.19.1
kyverno-reports-controller reg.kyverno.io/kyverno/reports-controller:v1.19.1
$ kubectl apply -f - <<'EOF'
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: legacy-shape }
spec:
  validationFailureAction: Audit
  rules:
    - name: has-team-label
      match:
        any:
          - resources: { kinds: [Pod], namespaces: [default] }
      validate:
        message: "pods should carry a team label"
        pattern:
          metadata:
            labels:
              team: "?*"
EOF
Warning: kyverno.io/v1 ClusterPolicy is deprecated and will be removed in a future release; migrate to ValidatingPolicy, MutatingPolicy, GeneratingPolicy or ImageValidatingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/
clusterpolicy.kyverno.io/legacy-shape created
$ kubectl delete clusterpolicy legacy-shape
Warning: kyverno.io/v1 ClusterPolicy is deprecated and will be removed in a future release; migrate to ValidatingPolicy, MutatingPolicy, GeneratingPolicy or ImageValidatingPolicy (policies.kyverno.io), see https://kyverno.io/docs/guides/migration-to-cel/
clusterpolicy.kyverno.io "legacy-shape" deleted

$ kubectl apply -f - <<'EOF'
apiVersion: policies.kyverno.io/v1
kind: ValidatingPolicy
metadata: { name: require-team-label }
spec:
  # autogen is on by default, so without this the first half is already a Deployment-level deny
  autogen:
    podControllers:
      controllers: ["none"]
  validationActions: [Deny]
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  validations:
    - expression: "has(object.metadata.labels) && has(object.metadata.labels.team)"
      message: "every pod must carry a team label"
EOF
validatingpolicy.policies.kyverno.io/require-team-label created
$ sleep 15
$ kubectl -n default create deployment unlabelled --image=nginx:1.27-alpine
deployment.apps/unlabelled created
$ sleep 20
$ kubectl -n default get deploy unlabelled -o jsonpath='{.status.conditions}' | jq '.[] | {type, status, reason, message}'
{
  "type": "Progressing",
  "status": "True",
  "reason": "NewReplicaSetCreated",
  "message": "Created new replica set \"unlabelled-6896b8687b\""
}
{
  "type": "Available",
  "status": "False",
  "reason": "MinimumReplicasUnavailable",
  "message": "Deployment does not have minimum availability."
}
{
  "type": "ReplicaFailure",
  "status": "True",
  "reason": "FailedCreate",
  "message": "admission webhook \"vpol.validate.kyverno.svc-fail\" denied the request: Policy require-team-label failed: every pod must carry a team label"
}
$ kubectl -n default get events --field-selector reason=FailedCreate | tail -3
LAST SEEN   TYPE      REASON         OBJECT                             MESSAGE
10s         Warning   FailedCreate   replicaset/unlabelled-6896b8687b   Error creating: admission webhook "vpol.validate.kyverno.svc-fail" denied the request: Policy require-team-label failed: every pod must carry a team label
$ kubectl -n default delete deployment unlabelled
deployment.apps "unlabelled" deleted from default namespace
$ kubectl patch validatingpolicy require-team-label --type merge -p '{"spec":{"autogen":{"podControllers":{"controllers":["deployments"]}}}}'
validatingpolicy.policies.kyverno.io/require-team-label patched
$ sleep 20
$ kubectl -n default create deployment unlabelled --image=nginx:1.27-alpine
error: failed to create deployment: admission webhook "vpol.validate.kyverno.svc-fail" denied the request: Policy require-team-label failed: every pod must carry a team label
$ kubectl -n default delete deployment unlabelled --ignore-not-found
$ kubectl delete validatingpolicy require-team-label
validatingpolicy.policies.kyverno.io "require-team-label" deleted
$ kubectl get validatingpolicy require-team-label -o jsonpath='{.spec.autogen}{"\n"}'
Error from server (NotFound): validatingpolicies.policies.kyverno.io "require-team-label" not found

$ kubectl apply -f - <<'EOF'
apiVersion: policies.kyverno.io/v1
kind: ValidatingPolicy
metadata: { name: no-latest }
spec:
  validationActions: [Deny]
  autogen:
    validatingAdmissionPolicy: { enabled: true }
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["pods"]
  validations:
    - expression: "object.spec.containers.all(c, !c.image.endsWith(':latest'))"
      message: "no :latest tags"
EOF
validatingpolicy.policies.kyverno.io/no-latest created
$ sleep 60
$ kubectl get validatingadmissionpolicies
NAME                                      VALIDATIONS   PARAMKIND   AGE
safe-upgrades.gateway.networking.k8s.io   2             <unset>     20h
vpol-no-latest                            1             <unset>     60s
$ kubectl get validatingadmissionpolicybindings
NAME                                      POLICYNAME                                PARAMREF   AGE
safe-upgrades.gateway.networking.k8s.io   safe-upgrades.gateway.networking.k8s.io   <unset>    20h
vpol-no-latest-binding                    vpol-no-latest                            <unset>    60s
$ kubectl get validatingadmissionpolicy -o jsonpath='{range .items[*]}{.metadata.name} {.spec.validations[*].expression}{"\n"}{end}'
safe-upgrades.gateway.networking.k8s.io object.spec.group != 'gateway.networking.k8s.io' || oldObject == null || ( has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && object.metadata.annotations['gateway.networking.k8s.io/channel'] == 'standard' ) || ( oldObject != null && has(oldObject.metadata.annotations) && oldObject.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/channel') && oldObject.metadata.annotations['gateway.networking.k8s.io/channel'] == 'experimental' ) object.spec.group != 'gateway.networking.k8s.io' || (has(object.metadata.annotations) && object.metadata.annotations.exists(k, k == 'gateway.networking.k8s.io/bundle-version') && ( matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], '-(rc)') || ( !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v1.[0-5].\\d+') && !matches(object.metadata.annotations['gateway.networking.k8s.io/bundle-version'], 'v0') ) ))
vpol-no-latest object.spec.containers.all(c, !c.image.endsWith(':latest'))
$ kubectl get validatingpolicy no-latest -o jsonpath='{.spec.autogen}{"\n"}'
{"validatingAdmissionPolicy":{"enabled":true}}
$ kubectl -n kyverno logs deploy/kyverno-admission-controller --tail=50 | grep -i -m5 'validatingadmissionpolicy' || true
Defaulted container "kyverno" out of: kyverno, kyverno-pre (init)
$ kubectl delete validatingpolicy no-latest
validatingpolicy.policies.kyverno.io "no-latest" deleted

$ kubectl -n kyverno get deploy kyverno-admission-controller -o jsonpath='{.spec.template.spec.containers[0].args}' | jq
[
  "--caSecretName=kyverno-svc.kyverno.svc.kyverno-tls-ca",
  "--tlsSecretName=kyverno-svc.kyverno.svc.kyverno-tls-pair",
  "--tlsKeyAlgorithm=RSA",
  "--backgroundServiceAccountName=system:serviceaccount:kyverno:kyverno-background-controller",
  "--reportsServiceAccountName=system:serviceaccount:kyverno:kyverno-reports-controller",
  "--servicePort=443",
  "--webhookServerPort=9443",
  "--resyncPeriod=15m",
  "--crdWatcher=false",
  "--disableMetrics=false",
  "--otelConfig=prometheus",
  "--metricsPort=8000",
  "--admissionReports=true",
  "--maxAdmissionReports=1000",
  "--autoUpdateWebhooks=true",
  "--excludeBootstrapResources=false",
  "--enableConfigMapCaching=true",
  "--controllerRuntimeMetricsAddress=:8080",
  "--enableDeferredLoading=true",
  "--dumpPayload=false",
  "--forceFailurePolicyIgnore=false",
  "--generateValidatingAdmissionPolicy=true",
  "--generateMutatingAdmissionPolicy=false",
  "--dumpPatches=false",
  "--maxAPICallResponseLength=2000000",
  "--apiCallTimeout=30s",
  "--maxGlobalContextEntries=0",
  "--loggingFormat=text",
  "--v=2",
  "--omitEvents=PolicyApplied,PolicySkipped",
  "--enablePolicyException=true",
  "--protectManagedResources=false",
  "--allowInsecureRegistry=true",
  "--registryCredentialHelpers=default,google,amazon,azure,github",
  "--enableReporting=validate,mutate,mutateExisting,imageVerify,generate"
]
$ kubectl create ns policy-exception --dry-run=client -o yaml | kubectl apply -f -
namespace/policy-exception created
$ kubectl apply -f - <<'EOF'
apiVersion: policies.kyverno.io/v1
kind: PolicyException
metadata: { name: legacy-job, namespace: policy-exception }
spec:
  policyRefs:
    - name: require-resource-requests
      kind: ValidatingPolicy
  matchConditions:
    - name: only-the-legacy-pod
      expression: "object.metadata.name == 'legacy'"
EOF
policyexception.policies.kyverno.io/legacy-job created
$ kubectl -n default run legacy --image=nginx:1.27-alpine --restart=Never
pod/legacy created
$ # the reports controller runs behind admission, so wait for the report rather than guessing a sleep
$ for i in $(seq 18); do kubectl -n default get policyreport -o json | jq -e '[.items[]|select(.scope.name=="legacy")]|length>0' >/dev/null && break; sleep 5; done; echo "report after ~$((i*5))s"
report after ~25s
$ kubectl -n default get policyreport
NAME                                   KIND   NAME     PASS   FAIL   WARN   ERROR   SKIP   AGE
7a647270-939c-44f6-a2cf-126b21a8210d   Pod    legacy   0      0      0      0       1      1s
$ kubectl -n default get policyreport -o json | jq -r '.items[] | select(.scope.name=="legacy") | .results[] | "\(.policy) \(.result)"'
require-resource-requests skip
$ kubectl -n default delete pod legacy --ignore-not-found
pod "legacy" deleted from default namespace
$ kubectl -n policy-exception delete policyexceptions.policies.kyverno.io legacy-job
policyexception.policies.kyverno.io "legacy-job" deleted from policy-exception namespace
$ kubectl delete ns policy-exception
namespace "policy-exception" deleted

$ START=$PWD   # the cd below would otherwise follow you into every later command
$ mkdir -p "$HOME/.local/bin"; export PATH="$HOME/.local/bin:$PATH"
$ URL=$(curl -s https://api.github.com/repos/kyverno/kyverno/releases/latest | jq -r '.assets[] | select(.name | startswith("kyverno-cli_") and endswith("_linux_x86_64.tar.gz")) | .browser_download_url'); echo "$URL"
https://github.com/kyverno/kyverno/releases/download/v1.19.1/kyverno-cli_v1.19.1_linux_x86_64.tar.gz
$ rm -rf /tmp/kyverno-cli && mkdir -p /tmp/kyverno-cli && curl -sL "$URL" | tar xz -C /tmp/kyverno-cli && install /tmp/kyverno-cli/kyverno "$HOME/.local/bin/"
$ kyverno version | head -2
Version: 1.19.1
Time: 2026-09-10T05:20:21Z
$ rm -rf /tmp/kyverno-test && mkdir -p /tmp/kyverno-test && cd /tmp/kyverno-test
$ cp "$REPO_ROOT"/examples/kyverno/require-resources.yaml policy.yaml
$ cat > good-pod.yaml <<'EOF'
apiVersion: v1
kind: Pod
metadata: { name: good, namespace: default }
spec:
  containers:
    - name: c
      image: nginx:1.27-alpine
      resources:
        requests: { cpu: 25m, memory: 32Mi }
EOF
$ cat > bad-pod.yaml <<'EOF'
apiVersion: v1
kind: Pod
metadata: { name: bad, namespace: default }
spec:
  containers:
    - name: c
      image: nginx:1.27-alpine
EOF
$ kyverno apply policy.yaml --resource good-pod.yaml --resource bad-pod.yaml

Applying 1 policy rule(s) to 2 resource(s)...
policy require-resource-requests -> resource default/Pod/bad failed:
1 -  every container must set cpu and memory requests

pass: 1, fail: 1, warn: 0, error: 0, skip: 0 
$ cat > kyverno-test.yaml <<'EOF'
apiVersion: cli.kyverno.io/v1alpha1
kind: Test
metadata: { name: require-resources }
policies: [policy.yaml]
resources: [good-pod.yaml, bad-pod.yaml]
results:
  - policy: require-resource-requests
    resources: [good]
    kind: Pod
    result: pass
  - policy: require-resource-requests
    resources: [bad]
    kind: Pod
    result: fail
EOF
$ kyverno test .
Loading test  ( kyverno-test.yaml ) ...
  Loading values/variables ...
  Loading policies ...
  Loading resources ...
  Loading exceptions ...
  Applying 1 policy to 2 resources with 0 exceptions ...
  Checking results ...

│────│───────────────────────────│──────│─────────────────────│────────│────────│
│ ID │ POLICY                    │ RULE │ RESOURCE            │ RESULT │ REASON │
│────│───────────────────────────│──────│─────────────────────│────────│────────│
│ 1  │ require-resource-requests │      │ v1/Pod/default/good │ Pass   │ Ok     │
│ 2  │ require-resource-requests │      │ v1/Pod/default/bad  │ Pass   │ Ok     │
│────│───────────────────────────│──────│─────────────────────│────────│────────│


Test Summary: 2 tests passed and 0 tests failed
$ cd "$START"

$ kubectl apply -f - <<'EOF'
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata: { name: k8srequiredlabels }
spec:
  crd:
    spec:
      names: { kind: K8sRequiredLabels }
      validation:
        openAPIV3Schema:
          type: object
          properties:
            labels: { type: array, items: { type: string } }
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8srequiredlabels
        violation[{"msg": msg}] {
          required := input.parameters.labels[_]
          not input.review.object.metadata.labels[required]
          msg := sprintf("missing required label: %v", [required])
        }
EOF
constrainttemplate.templates.gatekeeper.sh/k8srequiredlabels created
$ sleep 20
$ kubectl apply -f - <<'EOF'
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sRequiredLabels
metadata: { name: pods-need-owner }
spec:
  enforcementAction: scoped
  scopedEnforcementActions:
    - action: warn
      enforcementPoints: [{ name: validation.gatekeeper.sh }]
    - action: deny
      enforcementPoints: [{ name: audit.gatekeeper.sh }]
  match:
    kinds:
      - { apiGroups: [""], kinds: [Pod] }
    namespaces: [default]
  parameters:
    labels: [owner]
EOF
k8srequiredlabels.constraints.gatekeeper.sh/pods-need-owner created
$ sleep 30
$ kubectl -n default run scoped-demo --image=nginx:1.27-alpine --restart=Never
Warning: [pods-need-owner] missing required label: owner
pod/scoped-demo created
$ sleep 90
$ kubectl get k8srequiredlabels pods-need-owner -o jsonpath='{.status.violations}' | jq
[
  {
    "enforcementAction": "scoped",
    "enforcementActions": [
      "deny"
    ],
    "group": "",
    "kind": "Pod",
    "message": "missing required label: owner",
    "name": "signed-86hrq-pod",
    "namespace": "default",
    "version": "v1"
  },
  {
    "enforcementAction": "scoped",
    "enforcementActions": [
      "deny"
    ],
    "group": "",
    "kind": "Pod",
    "message": "missing required label: owner",
    "name": "scoped-demo",
    "namespace": "default",
    "version": "v1"
  }
]
$ kubectl -n default delete pod scoped-demo --ignore-not-found
pod "scoped-demo" deleted from default namespace
$ kubectl delete k8srequiredlabels pods-need-owner
k8srequiredlabels.constraints.gatekeeper.sh "pods-need-owner" deleted
$ kubectl delete constrainttemplate k8srequiredlabels
constrainttemplate.templates.gatekeeper.sh "k8srequiredlabels" deleted

$ # Assign refuses to touch metadata; labels and annotations are AssignMetadata's job,
$ # and it only ever fills in a value that is absent, so no pathTests condition is needed
$ kubectl apply -f - <<'EOF'
apiVersion: mutations.gatekeeper.sh/v1
kind: AssignMetadata
metadata: { name: default-owner-label }
spec:
  match:
    scope: Namespaced
    namespaces: [default]
    kinds:
      - { apiGroups: ["*"], kinds: [Pod] }
  location: "metadata.labels.owner"
  parameters:
    assign:
      value: platform
EOF
assignmetadata.mutations.gatekeeper.sh/default-owner-label created
$ sleep 30
$ kubectl -n default run mutated --image=nginx:1.27-alpine --restart=Never
pod/mutated created
$ kubectl -n default get pod mutated -o jsonpath='{.metadata.labels.owner}{"\n"}'
platform
$ kubectl -n default run untouched --image=nginx:1.27-alpine --restart=Never --labels=owner=team-a
pod/untouched created
$ kubectl -n default get pod untouched -o jsonpath='{.metadata.labels.owner}{"\n"}'
team-a
$ kubectl -n default delete pod mutated untouched --ignore-not-found
pod "mutated" deleted from default namespace
pod "untouched" deleted from default namespace
$ kubectl delete assignmetadata default-owner-label
assignmetadata.mutations.gatekeeper.sh "default-owner-label" deleted

$ START=$PWD   # the cd below would otherwise follow you into every later command
$ mkdir -p "$HOME/.local/bin"; export PATH="$HOME/.local/bin:$PATH"
$ URL=$(curl -s https://api.github.com/repos/open-policy-agent/gatekeeper/releases/latest | jq -r '.assets[] | select(.name | startswith("gator-") and endswith("-linux-amd64.tar.gz")) | .browser_download_url'); echo "$URL"
https://github.com/open-policy-agent/gatekeeper/releases/download/v3.23.1/gator-v3.23.1-linux-amd64.tar.gz
$ rm -rf /tmp/gator-bin && mkdir -p /tmp/gator-bin && curl -sL "$URL" | tar xz -C /tmp/gator-bin && install /tmp/gator-bin/gator "$HOME/.local/bin/"
$ gator version
 ::::::::      :::     :::::::::::  ::::::::  :::::::::
:+:    :+:   :+: :+:       :+:     :+:    :+: :+:    :+:
+:+         +:+   +:+      +:+     +:+    +:+ +:+    +:+
:#:        +#++:++#++:     +#+     +#+    +:+ +#++:++#:
+#+   +#+# +#+     +#+     +#+     +#+    +#+ +#+    +#+
#+#    #+# #+#     #+#     #+#     #+#    #+# #+#    #+#
 ########  ###     ###     ###      ########  ###    ###
gator: gator is a suite of authorship tools for Gatekeeper

GitVersion:    v3.23.1+dirty
GitCommit:     2d0b6ad97cf3a8b8436a00a1f4b07b3a56b92ca0
GitTreeState:  dirty
BuildDate:     2026-08-27T21:26:44
GoVersion:     go1.26.0
Compiler:      gc
Platform:      linux/amd64
$ rm -rf /tmp/gator-ci && mkdir -p /tmp/gator-ci/policies /tmp/gator-ci/manifests && cd /tmp/gator-ci
$ cat > policies/template.yaml <<'EOF'
apiVersion: templates.gatekeeper.sh/v1
kind: ConstraintTemplate
metadata: { name: k8sdenylatest }
spec:
  crd:
    spec:
      names: { kind: K8sDenyLatest }
  targets:
    - target: admission.k8s.gatekeeper.sh
      rego: |
        package k8sdenylatest
        violation[{"msg": msg}] {
          c := input.review.object.spec.containers[_]
          endswith(c.image, ":latest")
          msg := sprintf("image uses the latest tag: %v", [c.image])
        }
EOF
$ cat > policies/constraint.yaml <<'EOF'
apiVersion: constraints.gatekeeper.sh/v1beta1
kind: K8sDenyLatest
metadata: { name: no-latest-anywhere }
spec:
  match:
    kinds:
      - { apiGroups: [""], kinds: [Pod] }
EOF
$ cat > manifests/pods.yaml <<'EOF'
apiVersion: v1
kind: Pod
metadata: { name: pinned }
spec:
  containers: [{ name: c, image: nginx:1.27-alpine }]
---
apiVersion: v1
kind: Pod
metadata: { name: floating }
spec:
  containers: [{ name: c, image: nginx:latest }]
EOF
$ gator test -f manifests/ -f policies/; echo "exit code: $?"
v1/Pod floating: ["no-latest-anywhere"] Message: "image uses the latest tag: nginx:latest"
exit code: 1
$ cd "$START"

$ kubectl apply -f - <<'EOF'
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata: { name: typo-policy }
spec:
  failurePolicy: Fail
  matchConstraints:
    resourceRules:
      - apiGroups: ["apps"]
        apiVersions: ["v1"]
        operations: ["CREATE", "UPDATE"]
        resources: ["deployments"]
  validations:
    - expression: "object.spec.replicaCount <= 10"
      message: "at most ten replicas"
EOF
validatingadmissionpolicy.admissionregistration.k8s.io/typo-policy created
$ sleep 10
$ kubectl get validatingadmissionpolicy typo-policy -o jsonpath='{.status.typeChecking}' | jq
{
  "expressionWarnings": [
    {
      "fieldRef": "spec.validations[0].expression",
      "warning": "apps/v1, Kind=Deployment: ERROR: <input>:1:12: undefined field 'replicaCount'\n | object.spec.replicaCount <= 10\n | ...........^\n"
    }
  ]
}
$ kubectl apply -f - <<'EOF'
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata: { name: typo-policy-binding }
spec:
  policyName: typo-policy
  validationActions: [Deny]
  matchResources:
    namespaceSelector:
      matchLabels: { kubernetes.io/metadata.name: default }
EOF
validatingadmissionpolicybinding.admissionregistration.k8s.io/typo-policy-binding created
$ sleep 10
$ kubectl -n default create deployment typo-test --image=nginx:1.27-alpine
error: failed to create deployment: deployments.apps "typo-test" is forbidden: ValidatingAdmissionPolicy 'typo-policy' with binding 'typo-policy-binding' denied request: expression 'object.spec.replicaCount <= 10' resulted in error: no such key: replicaCount
$ kubectl patch validatingadmissionpolicy typo-policy --type merge -p '{"spec":{"failurePolicy":"Ignore"}}'
validatingadmissionpolicy.admissionregistration.k8s.io/typo-policy patched
$ sleep 10
$ kubectl -n default create deployment typo-test --image=nginx:1.27-alpine
deployment.apps/typo-test created
$ kubectl -n default delete deployment typo-test --ignore-not-found
deployment.apps "typo-test" deleted from default namespace
$ kubectl delete validatingadmissionpolicybinding typo-policy-binding
validatingadmissionpolicybinding.admissionregistration.k8s.io "typo-policy-binding" deleted
$ kubectl delete validatingadmissionpolicy typo-policy
validatingadmissionpolicy.admissionregistration.k8s.io "typo-policy" deleted

$ kubectl api-resources | grep -i mutatingadmissionpolicy
mutatingadmissionpolicies                                                             admissionregistration.k8s.io/v1           false        MutatingAdmissionPolicy
mutatingadmissionpolicybindings                                                       admissionregistration.k8s.io/v1           false        MutatingAdmissionPolicyBinding
$ kubectl apply -f - <<'EOF'
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicy
metadata: { name: add-platform-label }
spec:
  matchConstraints:
    resourceRules:
      - apiGroups: [""]
        apiVersions: ["v1"]
        operations: ["CREATE"]
        resources: ["pods"]
  failurePolicy: Fail
  reinvocationPolicy: Never
  mutations:
    - patchType: ApplyConfiguration
      applyConfiguration:
        expression: |
          Object{ metadata: Object.metadata{ labels: {"managed-by": "platform"} } }
---
apiVersion: admissionregistration.k8s.io/v1
kind: MutatingAdmissionPolicyBinding
metadata: { name: add-platform-label-binding }
spec:
  policyName: add-platform-label
  matchResources:
    namespaceSelector:
      matchLabels: { kubernetes.io/metadata.name: default }
EOF
mutatingadmissionpolicy.admissionregistration.k8s.io/add-platform-label created
mutatingadmissionpolicybinding.admissionregistration.k8s.io/add-platform-label-binding created
$ sleep 15
$ kubectl -n default run mutated-native --image=nginx:1.27-alpine --restart=Never --overrides='{"spec":{"containers":[{"name":"mutated-native","image":"nginx:1.27-alpine","resources":{"requests":{"cpu":"25m","memory":"32Mi"}}}]}}'
pod/mutated-native created
$ kubectl -n default get pod mutated-native -o jsonpath='{.metadata.labels}{"\n"}'
{"managed-by":"platform","run":"mutated-native","topology.kubernetes.io/zone":"zone-b"}
$ kubectl -n default delete pod mutated-native --ignore-not-found
pod "mutated-native" deleted from default namespace
$ kubectl delete mutatingadmissionpolicybinding add-platform-label-binding
mutatingadmissionpolicybinding.admissionregistration.k8s.io "add-platform-label-binding" deleted
$ kubectl delete mutatingadmissionpolicy add-platform-label
mutatingadmissionpolicy.admissionregistration.k8s.io "add-platform-label" deleted