apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-labels
spec:
  background: false
  rules:
    - name: check-for-labels
      match:
        any:
        - resources:
            kinds:
            - Deployment
      preconditions:
        any:
        - key: "{{ request.object.metadata.namespace }}"
          operator: AllNotIn
          value:
            - kyverno
            - def*
      validate:
        message: "label 'app.kubernetes.io/name' is required"
        pattern:
          metadata:
            labels:
              app.kubernetes.io/name: "?*"
  validationFailureAction: enforce
