- name: "kernel module rule"
  labels:
    "kernel-br_netfilter.present": "true"
  matchFeatures:
    - feature: "kernel.loadedmodule"
      matchExpressions:
        br_netfilter: {op: Exists}

- name: "nodename rule"
  labels:
    "nodename-rule.matches": "true"
  matchFeatures:
    - feature: "system.name"
      matchExpressions:
        nodename: {op: InRegexp, value: ["special-.*-node"]}