Add Privileged Label to Existing Namespaces

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: add-privileged-existing-namespaces
  annotations:
    policies.kyverno.io/title: Add Privileged Label to Existing Namespaces
    policies.kyverno.io/category: Pod Security Admission
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Namespace
    kyverno.io/kyverno-version: 1.8.0
    policies.kyverno.io/minversion: 1.7.0
    kyverno.io/kubernetes-version: "1.24"
    policies.kyverno.io/description: "When Pod Security Admission is configured with a cluster-wide AdmissionConfiguration file which sets either baseline or restricted, for example in many PaaS CIS profiles, it may be necessary to relax this to privileged on a per-Namespace basis so that more granular control can be provided. This policy labels new and existing Namespaces, except that of kube-system, with the `pod-security.kubernetes.io/enforce: privileged` label."
spec:
  mutateExistingOnPolicyUpdate: true
  rules:
    - name: label-privileged-namespaces
      match:
        any:
          - resources:
              kinds:
                - Namespace
      mutate:
        targets:
          - apiVersion: v1
            kind: Namespace
        patchStrategicMerge:
          metadata:
            <(name): "!kube-system"
            labels:
              pod-security.kubernetes.io/enforce: privileged