Add rules to disallow default namespace for pod controllers.

samples/best_practices/disallow_default_namespace.yaml

@@ -3,6 +3,7 @@ kind: ClusterPolicy
 metadata:
   name: disallow-default-namespace
   annotations:
+    pod-policies.kyverno.io/autogen-controllers: none	
     policies.kyverno.io/category: Workload Isolation
     policies.kyverno.io/description: Kubernetes namespaces are an optional feature 
       that provide a way to segment and isolate cluster resources across multiple 
@@ -31,4 +32,30 @@ spec:
       pattern:
         metadata:
           namespace: "?*"
+  - name: validate-podcontroller-namespace
+    match:
+      resources:
+        kinds:
+        - DaemonSet
+        - Deployment
+        - Job
+        - StatefulSet
+    validate:
+      message: "Using 'default' namespace is not allowed for podcontrollers"
+      pattern:
+        metadata:
+          namespace: "!default"
+  - name: require-podcontroller-namespace
+    match:
+      resources:
+        kinds:
+        - DaemonSet
+        - Deployment
+        - Job
+        - StatefulSet
+    validate:
+      message: "A namespace is required for podcontrollers"
+      pattern:
+        metadata:
+          namespace: "?*"