apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
   name: enforce-label
spec:
   validationFailureAction: Audit
   background: false
   rules:
     - name: enforce-label
       match:
         any:
         - resources:
             kinds:
               - Pod
       validate:
         message: "The foo label must be set."
         pattern:
           metadata:
             labels:
               op: "{{ request.operation }}"