apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-privileged-existing-namespaces
  annotations:
    policies.kyverno.io/title: Add Privileged Label to Existing Namespaces
    policies.kyverno.io/category: Pod Security Admission
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Namespace
    kyverno.io/kyverno-version: 1.8.0
    policies.kyverno.io/minversion: 1.7.0
    kyverno.io/kubernetes-version: "1.24"
    policies.kyverno.io/description: >-
      When Pod Security Admission is configured with a cluster-wide AdmissionConfiguration file
      which sets either baseline or restricted, for example in many PaaS CIS profiles, it may
      be necessary to relax this to privileged on a per-Namespace basis so that more
      granular control can be provided. This policy labels new and existing Namespaces, except
      that of kube-system, with the `pod-security.kubernetes.io/enforce: privileged` label.      
spec:
  mutateExistingOnPolicyUpdate: true
  background: false
  rules:
  - name: label-privileged-namespaces
    match:
      any:
      - resources:
          kinds:
          - Namespace
    mutate:
      targets:
        - apiVersion: v1
          kind: Namespace
      patchStrategicMerge:
        metadata:
          labels:
            foo: bar