policies:
  - name: deny-exec-by-pod-label
    rules:
      - name: deny-exec-by-label
        values:
          podexeclabel: "false"
globalValues:
  request.operation: CONNECT
subresources:
  - subresource:
      name: "pods/exec"
      kind: "PodExecOptions"
      version: "v1"
    parentResource:
      name: "pods"
      kind: "Pod"
      version: "v1"