Restrict node label creation

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: restrict-node-label-creation
 5  annotations:
 6    policies.kyverno.io/title: Restrict node label creation
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Node, Label
 9    policies.kyverno.io/minversion: 1.6.0
10    policies.kyverno.io/description: >-
11      Node labels are critical pieces of metadata upon which many other applications and
12      logic may depend and should not be altered or removed by regular users. Many cloud
13      providers also use Node labels to signal specific functions to applications.
14      This policy prevents setting of a new label called `foo` on
15      cluster Nodes. Use of this policy requires removal of the Node resource filter
16      in the Kyverno ConfigMap ([Node,*,*]). Due to Kubernetes CVE-2021-25735, this policy
17      requires, at minimum, one of the following versions of Kubernetes:
18      v1.18.18, v1.19.10, v1.20.6, or v1.21.0.
19spec:
20  validationFailureAction: Enforce
21  background: false
22  rules:
23  - name: prevent-label-set
24    match:
25      any:
26      - resources:
27          kinds:
28          - Node
29    preconditions:
30      all:
31      - key: "{{request.operation || 'BACKGROUND'}}"
32        operator: Equals
33        value: UPDATE
34      - key: "{{request.object.metadata.labels.foo || '' }}"
35        operator: Equals
36        value: "?*"
37    validate:
38      message: "Setting the `foo` label on a Node is not allowed."
39      deny: {}