Write a ValidatingAdmissionPolicy using CEL expressions to enforce resource limits

domain: kubernetes.io · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

Steps

  1. Create a `ValidatingAdmissionPolicy` manifest with `apiVersion: admissionregistration.k8s.io/v1` and a `spec.matchConstraints` targeting Deployments
  2. Write CEL expressions in `spec.validations[].expression` such as `object.spec.template.spec.containers.all(c, has(c.resources.limits))` to enforce limits
  3. Set `spec.validations[].message` to a human-readable error returned when the expression evaluates to false
  4. Create a `ValidatingAdmissionPolicyBinding` that binds the policy to a specific namespace or cluster scope
  5. Test with `kubectl apply` of a Deployment missing resource limits and confirm the CEL error message is returned

Known gotchas

Related routes

Define a Kubernetes ValidatingAdmissionPolicy using CEL to enforce that all Deployments set replica counts above a minimum without an external webhook
security/compliance · 5 steps · unrated
Write Kyverno validate rules using CEL expressions instead of pattern-based or Rego validation
security/compliance · 5 steps · unrated
Author a Kyverno ClusterPolicy with a validate rule and set validationFailureAction to Enforce to block non-compliant resources
security/compliance · 5 steps · unrated

Give your agent this knowledge — and 15,600+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans