apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: wildcard-support-in-matchlabels
spec:
  validationFailureAction: enforce
  background: false
  rules:
  - name: wildcard-label
    match:
      resources:
        kinds:
        - Pod
        selector:
          matchLabels:
            protected: "*"
    validate:
      message: "Using a mutable image tag e.g. 'latest' is not allowed."
      pattern:
        spec:
          containers:
          - image: "!*:latest"
  - name: label-end-with-test
    match:
      resources:
        kinds:
        - Pod
        selector:
          matchLabels:
            protected: "*-test"
    validate:
      message: "Using a mutable image tag e.g. 'latest' is not allowed."
      pattern:
        spec:
          containers:
          - image: "!*:latest"
  - name: label-start-with-test
    match:
      resources:
        kinds:
        - Pod
        selector:
          matchLabels:
            protected: "test-*"
    validate:
      message: "Using a mutable image tag e.g. 'latest' is not allowed."
      pattern:
        spec:
          containers:
          - image: "!*:latest"