# Kubernetes Mutating Admission Policies with Kyverno

Let's take our Kubernetes security journey to the next level! In our previous blog, we explored the power of Kyverno for validating admission policies. If you missed it, catch up here:

%[https://ajayproject.com/preview/6647e4a3add80aae7de781e1] 

%[https://ajayproject.com/securing-kubernetes-with-opa-and-gatekeeper] 

Now, we're excited to dive into the world of Mutating Admission Policies with Kyverno. In this blog, we'll uncover the potential of Kyverno by implementing few fascinating Mutating policies that will streamline your cluster management and enhance security.

Assuming you've installed Kyverno on your cluster (if not, run bellow command to install it)

```yaml
kubectl create -f https://github.com/kyverno/kyverno/releases/download/v1.12.0/install.yaml
```

let's dive into implementing Mutating Admission Policies.

**Our first scenario: adding default security context to pods.**

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-securitycontext
spec:
  rules:
  - name: add-default-securitycontext
    match:
      any:
      - resources:
          kinds:
          - Pod
    mutate:
      patchStrategicMerge:
        spec:
          securityContext:
            +(runAsNonRoot): true
            +(runAsUser): 1000
            +(runAsGroup): 3000
            +(fsGroup): 2000
```

Now, Apply above policy.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720993955213/17316c2d-05f1-4319-bb9c-5006a6180998.png align="center")

Now try to create a pod without security context

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720994494148/374bf37d-44e4-4084-9d24-114fb30bb565.png align="center")

If you exec into the pod, you'll see that the sleep command runs as a non-root user (1000)!"

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720994579381/74e9abb5-41d1-4268-bc94-47fecf21d110.png align="center")

**Our second scenario: adding default resource requests (e.g., CPU and memory) for containers in pods that don't specify them**

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-default-resources
spec:
  rules:
    - name: add-default-requests
      match:
        any:
          - resources:
              kinds:
                - Pod
      mutate:
        patchStrategicMerge:
          spec:
            containers:
              - name: "*"
                resources:
                  requests:
                    +(cpu): 50m
                    +(memory): 64Mi
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720995502964/695fb868-393e-4b55-9d64-a7f85ba07bda.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720996403897/31ad5e4d-5889-49ec-b6cd-af8a34185a9b.png align="center")

Now when you describe created pod, You will see,

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720996504124/cdba25c5-502f-4991-8401-c0ef5bde743b.png align="center")

<mark>These can you production usecase.</mark>

**Our Third scenario is add default label in particular pod. For instance, if you want there should be label "backup-needed=yes" in every database related pod.**

```yaml
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: database-backup-labeling
spec:
  rules:
    - name: assign-backup-database
      match:
        any:
        - resources:
            kinds:
              - Pod
            selector:
              matchLabels:
                type: database
      mutate:
        patchStrategicMerge:
          metadata:
            labels:
              +(backup-needed): "yes"
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720997381615/553342c7-2e70-4472-8e0e-dcff5ffa3d84.png align="center")

Now , if you check labels

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1720997475410/9ef76bdf-54a9-41be-9686-f952fdbff209.png align="center")

That's a wrap for today's blog! Thanks for joining me on this Kubernetes journey. Stay tuned for our next blog, where we'll dive into more exciting topics related to Kubernetes. Until then, keep on hustling and remember to always keep your cluster secure and your containers shipping!