apiVersion: kyverno.io/v1alpha1
kind: Policy
metadata:
  name: policy-statefulset
spec:
  rules:
    - name: statefulset1
      match:
        resources:
          kinds :
          - StatefulSet
          selector:
            matchLabels:
              originalLabel: isHere
      mutate:
        patches:
        - path: "/spec/template/metadata/labels/isMutated"
          op: add
          value: "true"
        - path: "/metadata/labels/isMutated"
          op: add
          value: "true"
        - path : "/metadata/labels/originalLabel"
          op : remove
        - path : "/spec/serviceName"
          op : replace
          value : "not-a-nginx"
      validate:
        message: "This SS is broken"
        pattern:
          spec:
            replicas: ">2"
            volumeClaimTemplates:
            - metadata:
                name: www
              spec:
                resources:
                  requests:
                    storage: "<50Gi"