---
apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: spread-pods
spec:
  admission: true
  background: true
  rules:
  - match:
      any:
      - resources:
          kinds:
          - Deployment
          selector:
            matchLabels:
              distributed: required
    mutate:
      patchStrategicMerge:
        spec:
          template:
            spec:
              +(topologySpreadConstraints):
              - labelSelector:
                  matchLabels:
                    distributed: required
                maxSkew: 1
                topologyKey: zone
                whenUnsatisfiable: DoNotSchedule
    name: spread-pods-across-nodes
  validationFailureAction: Audit