Restrict node label creation in CEL expressions

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: restrict-node-label-creation
 5  annotations:
 6    policies.kyverno.io/title: Restrict node label creation in CEL expressions
 7    policies.kyverno.io/category: Sample in CEL 
 8    policies.kyverno.io/subject: Node, Label
 9    kyverno.io/kyverno-version: 1.12.1
10    kyverno.io/kubernetes-version: "1.26-1.27"
11    policies.kyverno.io/description: >-
12      Node labels are critical pieces of metadata upon which many other applications and
13      logic may depend and should not be altered or removed by regular users. Many cloud
14      providers also use Node labels to signal specific functions to applications.
15      This policy prevents setting of a new label called `foo` on
16      cluster Nodes. Use of this policy requires removal of the Node resource filter
17      in the Kyverno ConfigMap ([Node,*,*]). Due to Kubernetes CVE-2021-25735, this policy
18      requires, at minimum, one of the following versions of Kubernetes:
19      v1.18.18, v1.19.10, v1.20.6, or v1.21.0.
20spec:
21  validationFailureAction: Enforce
22  background: false
23  rules:
24  - name: prevent-label-set
25    match:
26      any:
27      - resources:
28          kinds:
29          - Node
30    celPreconditions: 
31      - name: "operation-should-be-update"
32        expression: "request.operation == 'UPDATE'"
33      - name: "has-foo-label"
34        expression: "object.metadata.?labels.?foo.hasValue()"
35    validate:
36      cel:
37        expressions:
38          - expression: "false"
39            message: "Setting the `foo` label on a Node is not allowed."