apiVersion: v1
kind: Namespace
metadata:
  name: test-cm-lookup
---
apiVersion: v1
kind: ConfigMap
metadata:
  namespace: test-cm-lookup
  name: keys
data:
  foo: bar
---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: validate-labels
spec:
  validationFailureAction: audit
  background: true
  rules:
    - name: validate-labels
      match:
        any:
        - resources:
            kinds:
              - Pod
      context:
      - name: keys
        configMap:
          name: keys
          namespace: test-cm-lookup
      validate:
        pattern:
          metadata:
            labels:
              foo: "{{ keys.data.foo }}"