Restrict Ingress defaultBackend

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-ingress-defaultbackend
  annotations:
    policies.kyverno.io/title: Restrict Ingress defaultBackend
    policies.kyverno.io/category: Best Practices
    policies.kyverno.io/severity: high
    kyverno.io/kyverno-version: 1.6.2
    policies.kyverno.io/minversion: 1.6.0
    kyverno.io/kubernetes-version: "1.23"
    policies.kyverno.io/subject: Ingress
    policies.kyverno.io/description: An Ingress with no rules sends all traffic to a single default backend. The defaultBackend is conventionally a configuration option of the Ingress controller and is not specified in your Ingress resources. If none of the hosts or paths match the HTTP request in the Ingress objects, the traffic is routed to your default backend. In a multi-tenant environment, you want users to use explicit hosts, they should not be able to overwrite the global default backend service. This policy prohibits the use of the defaultBackend field.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: restrict-ingress-defaultbackend
      match:
        any:
          - resources:
              kinds:
                - Ingress
      validate:
        message: Setting the defaultBackend field is prohibited.
        pattern:
          spec:
            X(defaultBackend): "null"