apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: preconditions
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: any-rule
    match:
      resources:
        kinds:
        - Pod
    preconditions:
      any:
      - key: "{{request.object.metadata.labels.app}}"
        operator: Equals
        value: busybox
    validate:
      message: "Busybox must be used based on this label combination."
      pattern:
        spec:
          containers:
          - name: "*busybox*"
