apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: ondemand
  annotations:
    policies.kyverno.io/description: >-
      This Policy contains two different types of rules that is validate 
      as well as mutate. The validate rule validate against the mutation or patches added by the mutate rule
      whereas mutate rule adds label for nodeSelector "osc.edu/role: ondemand".
spec:
  rules:
  - name: ondemand-managed_by
    match:
      any:
      - resources:
          kinds:
          - Pod
          namespaces:
          - "user-?*"
    validate:
      message: "{{ request.object.metadata.namespace }} pods must be managed by open-ondemand"
      pattern:
        metadata:
          labels:
            app.kubernetes.io/managed-by: "open-ondemand"
  - name: ondemand-nodeselector
    match:
      any:
      - resources:
          kinds:
          - Pod
          selector:
            matchLabels:
              app.kubernetes.io/managed-by: open-ondemand
    mutate:
      patchStrategicMerge:
        spec:
          nodeSelector:
            osc.edu/role: ondemand