Preconditions vs operations

[RelativeSure]

Kyverno Version

1.10.x

Kubernetes Version

1.25.x

Kubernetes Platform

Other (specify in description)

Description

Hi,
I don't know if I picked the correct issue template, please correct me if I did not.
I have been chatting with my coworker if we should use preconditions or operations when excluding DELETE operation.
Is there any difference if we use preconditions or operations for it?
Any ressource usage differences?
Does the policies act differently?
Any difference if it's mutations or validation policies?
We use Rancher 2.7.9 on-prem, if that helps.
I did this for mutations:

      match:
        any:
          - resources:
              kinds:
                - Pod
              operations:
                - CREATE
                - UPDATE

Validation:

      preconditions:
        all:
          - key: "{{ request.operation }}"
            operator: NotEquals
            value: DELETE

Steps to reproduce

1. Difference between operations and preconditions

Expected behavior

It could, maybe should, be easier way to read the difference on the website

Screenshots

No response

Kyverno logs

No response

Slack discussion

No response

Troubleshooting

• I have read and followed the documentation AND the troubleshooting guide.
• I have searched other issues in this repository and mine is not recorded.

[chipzoller]

This is a question and not a bug. The policy will behave the same way regardless of where the expression is placed. The only difference being how it is reported upon (if you care about reports). A failed expression in a precondition will result in a skip whereas the same expression in a deny.conditions block will result in a fail.