apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: test
spec:
  rules:
  - match:
      any:
      - resources:
          kinds:
          - acid.zalan.do/v1/postgresql
    name: test-rule
    validate:
      failureAction: Enforce
      message: The label app=foo is required
      pattern:
        metadata:
          labels:
            app: foo