Restrict node selection

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: restrict-node-selection
  annotations:
    policies.kyverno.io/title: Restrict node selection
    policies.kyverno.io/category: Sample
    policies.kyverno.io/subject: Pod
    policies.kyverno.io/minversion: 1.6.0
    policies.kyverno.io/description: The Kubernetes scheduler uses complex logic to determine the optimal placement for new Pods. Users who have access to set certain fields in a Pod spec may sidestep this logic which in many cases is undesirable. This policy prevents users from targeting specific Nodes for scheduling of Pods by prohibiting the use of the `nodeSelector` and `nodeName` fields. Note that this policy is only designed to work on initial creation and not in background mode.
spec:
  validationFailureAction: Audit
  background: false
  rules:
    - name: restrict-nodeselector
      match:
        any:
          - resources:
              kinds:
                - Pod
      preconditions:
        all:
          - key: "{{request.operation || 'BACKGROUND'}}"
            operator: Equals
            value: CREATE
      validate:
        message: Setting the nodeSelector field is prohibited.
        pattern:
          spec:
            X(nodeSelector): "null"
    - name: restrict-nodename
      match:
        any:
          - resources:
              kinds:
                - Pod
      preconditions:
        all:
          - key: "{{request.operation || 'BACKGROUND'}}"
            operator: Equals
            value: CREATE
      validate:
        message: Setting the nodeName field is prohibited.
        pattern:
          spec:
            X(nodeName): "null"