Restrict NetworkPolicy with Empty podSelector

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-networkpolicy-empty-podselector
  annotations:
    policies.kyverno.io/title: Restrict NetworkPolicy with Empty podSelector
    policies.kyverno.io/category: Other, Multi-Tenancy
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: NetworkPolicy
    policies.kyverno.io/description: By default, all pods in a Kubernetes cluster are allowed to communicate with each other, and all network traffic is unencrypted. It is recommended to not use an empty podSelector in order to more closely control the necessary traffic flows. This policy requires that all NetworkPolicies other than that of `default-deny` not use an empty podSelector.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: empty-podselector
      match:
        any:
          - resources:
              kinds:
                - NetworkPolicy
      exclude:
        any:
          - resources:
              kinds:
                - NetworkPolicy
              names:
                - default-deny
      validate:
        message: NetworkPolicies must not use an empty podSelector.
        deny:
          conditions:
            any:
              - key: "{{request.object.spec.podSelector.keys(@) | length(@)}}"
                operator: Equals
                value: 0