Restrict node label changes

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: protect-node-label-foo
 5  annotations:
 6    policies.kyverno.io/title: Restrict node label changes
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Node, Label
 9    policies.kyverno.io/minversion: 1.6.0
10    policies.kyverno.io/description: >-
11      Node labels are critical pieces of metadata upon which many other applications and
12      logic may depend and should not be altered or removed by regular users.
13      This policy prevents changes or deletions to a label called `foo` on
14      cluster Nodes. Use of this policy requires removal of the Node resource filter
15      in the Kyverno ConfigMap ([Node,*,*]). Due to Kubernetes CVE-2021-25735, this policy
16      requires, at minimum, one of the following versions of Kubernetes:
17      v1.18.18, v1.19.10, v1.20.6, or v1.21.0.
18spec:
19  validationFailureAction: Enforce
20  background: false
21  rules:
22  - name: prevent-label-value-changes
23    match:
24      any:
25      - resources:
26          kinds:
27          - Node
28    validate:
29      allowExistingViolations: false
30      message: "Modifying the `foo` label on a Node is not allowed."
31      deny:
32        conditions:
33          all:
34          - key: "{{ request.object.metadata.labels.foo || '' }}"
35            operator: NotEquals
36            value: ""
37          - key: "{{ request.object.metadata.labels.foo || '' }}"
38            operator: NotEquals
39            value: "{{ request.oldObject.metadata.labels.foo || '' }}"
40  - name: prevent-label-key-removal
41    match:
42      any:
43      - resources:
44          kinds:
45          - Node
46    preconditions:
47      all:
48      - key: "{{ request.operation || 'BACKGROUND' }}"
49        operator: Equals
50        value: UPDATE
51      - key: "{{ request.oldObject.metadata.labels.foo || '' }}"
52        operator: Equals
53        value: "?*"
54    validate:
55      allowExistingViolations: false
56      message: "Removing the `foo` label on a Node is not allowed."
57      pattern:
58        metadata:
59          labels:
60            foo: "*"