Restrict node label changes

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: protect-node-label-foo
 5  annotations:
 6    policies.kyverno.io/title: Restrict node label changes
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Node, Label
 9    policies.kyverno.io/description: >-
10      Node labels are critical pieces of metadata upon which many other applications and
11      logic may depend and should not be altered or removed by regular users.
12      This policy prevents changes or deletions to a label called `foo` on
13      cluster Nodes. Use of this policy requires removal of the Node resource filter
14      in the Kyverno ConfigMap ([Node,*,*]). Due to Kubernetes CVE-2021-25735, this policy
15      requires, at minimum, one of the following versions of Kubernetes:
16      v1.18.18, v1.19.10, v1.20.6, or v1.21.0.      
17spec:
18  validationFailureAction: audit
19  background: false
20  rules:
21  - name: prevent-label-value-changes
22    match:
23      resources:
24        kinds:
25        - Node
26    validate:
27      message: "Modifying the `foo` label on a Node is not allowed."
28      deny:
29        conditions:
30        - key: "{{ request.object.metadata.labels.foo }}"
31          operator: "NotEquals"
32          value: ""
33        - key: "{{ request.object.metadata.labels.foo }}"
34          operator: "NotEquals"
35          value: "{{ request.oldObject.metadata.labels.foo }}"
36  - name: prevent-label-key-removal
37    match:
38      resources:
39        kinds:
40        - Node
41    preconditions:
42    - key: "{{ request.operation }}"
43      operator: "Equals"
44      value: UPDATE
45    - key: "{{ request.oldObject.metadata.labels.foo }}"
46      operator: "Equals"
47      value: "*"
48    validate:
49      message: "Removing the `foo` label on a Node is not allowed."
50      pattern:
51        metadata:
52          labels:
53            foo: "*"