Page link

https://kyverno.io/docs/writing-policies/match-exclude/#match-statements

Description

In the second example in the documentation for match statements, the following code is given:

spec:
  rules:
  - name: no-LoadBalancer
    match:
      any:
      - resources:
          names: 
          - "prod-*"
          - "staging"
          kinds:
          - Service
      - resources:
          kinds:
          - Service
      - subjects:
        - kind: User
          name: dave

The description states:

match.any[1] will match all Services being created by the dave user regardless of the name of the Service. And since these two are specified under the any key, the entire rule will act on all Services with names prod-* or staging OR on all services being created by the dave user.

In other words, the logic described by the text is:

• Any service names prod-* or staging
• OR, Any service by user named dave

Expected behavior

But according to the syntax specified in the same page, the logic of the code is actually:

• Any service names prod-* or staging
• OR, Any service
• OR, any action by use named dave

Being new to Kyverno policies, I am yet not clear how to change the code to match the description.

Slack discussion

https://kubernetes.slack.com/archives/CLGR9BJU9/p1662998047002599