container.training/k8s/kyverno-pod-color-1.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: pod-color-policy-1
spec:
  rules:
  - name: ensure-pod-color-is-valid
    match:
      resources:
        kinds:
        - Pod
        selector:
          matchExpressions:
          - key: color
            operator: Exists
          - key: color
            operator: NotIn
            values: [ red, green, blue ]
    validate:
      failureAction: Enforce
      message: "If it exists, the label color must be red, green, or blue."
      deny: {}