Why ClusterPolicy Mutation Only Works For Pods Deployed In Default Namespace

[infinitydon]

Hi,

I want to create a cluster policy that will inject an init-container to PODs with a particular labels, below is what I tried but it is only working for PODs that are created in the default namespace:

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: multus-awsipmgt-inject-sidecar
  annotations:
    policies.kyverno.io/title: Inject Sidecar Container
    policies.kyverno.io/category: Sample
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/description: >-
      This policy injects an multus IP MGMT initContainer Pods that match
      an label called `multus-awsipmgt-inject: enabled`.
spec:
  rules:
    - name: add-initcontainer
      match:
        any:
        - resources:
            kinds:
            - Pod
            selector:
              matchLabels:
                multus-awsipmgt-inject: enabled
      mutate:
        patchStrategicMerge:
          spec:
            initContainers:
              - name: awsipmgmt
                image: xxxxxx/ip-manager:v0.1
                args: [/bin/sh, -c, '/app/script.sh initContainers']

When I create a POD in another namespace that is not the Default namespace, the mutation does not happen.

Will appreciate if someone can point out what the issue could be with the policy statement.

I am using the default helm installation

[chipzoller]

As long as you are not testing in a Namespace which has been excluded during the course of installing Kyverno it should work.

[infinitydon]

I didn't exclude the namespace, I am using a completely new namespace I created. Or does the default helm installation have some selective namespace configuration?

[chipzoller]

It only excludes Kyverno's Namespace and kube-system by default.

Can you show how you're testing this to determine it's not working.

[infinitydon]

Somehow seems to be working now, can't say what was wrong exactly. I will re-open if I experience the issue again.

Thanks for the quick respone.