apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels-demo
  annotations:
    policies.kyverno.io/title: "DEMO: Требовать обязательные labels"
    policies.kyverno.io/description: >-
      Демонстрационная политика для урока 6.2.
      Проверяет наличие labels 'app' и 'owner' у Pod.
spec:
  validationFailureAction: Audit
  background: true
  rules:
  - name: check-required-labels
    match:
      any:
      - resources:
          kinds:
          - Pod
    validate:
      message: "Pod must have labels 'app' and 'owner'."
      pattern:
        metadata:
          labels:
            app: "?*"
            owner: "?*"