kyverno/examples/cli/policy_deployment.yaml

apiVersion : kyverno.io/v1alpha1
kind : Policy
metadata :
  name : policy-deployment
spec :
  rules:
    - name: add-label
      resource:
        kinds : 
        - Deployment
        selector :
          matchLabels :
            cli: test
      mutate:
        patches:
        - path: /metadata/labels/isMutated
          op: add
          value: "true"
        - path: /metadata/labels/app
          op: replace
          value: "nginx_is_mutated" 
    - name: check-image
      resource:
        kinds : 
        - Deployment
        selector :
          matchLabels :
            cli: test
      validate:
        message: "The imagePullPolicy must be Always when :latest is used as a tag"
        pattern:
          spec:
            template:
              spec:
                containers:
                - (name): "*:latest"
                  imagePullPolicy: Always