apiVersion: kyverno.io/v1
kind: Policy
metadata:
  name: test-jmespath
  annotations:
    pod-policies.kyverno.io/autogen-controllers: none
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: test-jmespath
    match:
      resources:
        kinds:
        - Pod
    validate:
      message: 'All pod labels must match except test'
      deny:
        conditions:
          all:
          - key: '{{ request.object.metadata.labels | merge(@, `{"test": ""}`)}}'
            operator: NotEquals
            value:
              a: "1"
              test: ""
---
apiVersion: kyverno.io/v1
kind: Policy
metadata:
  name: namespace-validation
  namespace: kyverno
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: namespace-validation
    match:
      resources:
        kinds:
        - Namespace
    validate:
      message: "For creating a namespace you need to set the objectid of the Azure AD Group that needs access to this namespace as the aadobjectid label"
      deny:
        conditions:
        - key: "{{regex_match('^[a-fA-F0-9]{8}-[a-fA-F0-9]{4}-4[a-fA-F0-9]{3}-[8|9|aA|bB][a-fA-F0-9]{3}-[a-fA-F0-9]{12}$', '{{request.object.metadata.labels.aadobjectid}}')}}"
          operator: Equals
          value: false
