About this scenario
The cluster was upgraded to Kyverno 1.20 last week. The require-labels ClusterPolicy is still there and kubectl get cpol still says it is Ready, but 1.20 no longer runs kyverno.io policies. payments went out in the apps namespace without a version label and nothing stopped it.
Bring the rule back as a ValidatingPolicy from policies.kyverno.io/v1. Start in Audit mode, read the policy reports, fix what would break, then switch to Deny.
The old policy excluded the tools namespace, where a vendor's agent runs with labels you can't change. Keep that exemption with a PolicyException. The legacy manifest is in the editor as require-labels-cpol.yaml.
Objectives
- Check that the legacy ClusterPolicy is still listed as Ready
- Create the ValidatingPolicy require-labels, in Audit mode
- Read the policy reports to see which Pods fail
- payments passes: its Pods carry app and version
- A PolicyException exempts Pods in tools, and only those
- The policy denies: a Pod without the labels is rejected in apps
- Delete the legacy ClusterPolicy
- web, payments and vendor-agent keep running
What you'll practice
- Kyverno 1.20 stores
ClusterPolicy and the other kyverno.io kinds but no longer runs them. Their status is not updated either, so a policy can read Ready and enforce nothing. - The replacements each do one job:
ValidatingPolicy, MutatingPolicy, GeneratingPolicy. They match with matchConstraints and express rules in CEL. - CEL doesn't forgive missing fields the way patterns did.
object.metadata.?labels[?'app'].orValue('') returns a default where object.metadata.labels.app would error. validationActions: [Audit] records results in PolicyReports without blocking, which shows what Deny would break before you turn it on.- A
PolicyException replaces exclude blocks you can't express as a selector. It points at a policy by kind and name and scopes itself with matchConditions.
How the playground works
The cluster runs entirely in your browser: a simulated API server, scheduler, kubelets and controllers, with virtual nodes in three zones. kubectl output follows the real formats, errors use the real messages, and the add-ons (CSI storage, Traefik, Envoy Gateway, cert-manager, Helm, Flux, Argo CD, Kyverno, Cilium, Istio) behave like their real counterparts for the common paths. It's a simulation, so some behavior is simplified. Your progress is saved in this browser.