Restrict node label creation

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: restrict-node-label-creation
 5  annotations:
 6    policies.kyverno.io/title: Restrict node label creation
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Node, Label
 9    policies.kyverno.io/description: >-
10      Node labels are critical pieces of metadata upon which many other applications and
11      logic may depend and should not be altered or removed by regular users. Many cloud
12      providers also use Node labels to signal specific functions to applications.
13      This policy prevents setting of a new label called `foo` on
14      cluster Nodes. Use of this policy requires removal of the Node resource filter
15      in the Kyverno ConfigMap ([Node,*,*]). Due to Kubernetes CVE-2021-25735, this policy
16      requires, at minimum, one of the following versions of Kubernetes:
17      v1.18.18, v1.19.10, v1.20.6, or v1.21.0.      
18spec:
19  validationFailureAction: audit
20  background: false
21  rules:
22  - name: prevent-label-set
23    match:
24      resources:
25        kinds:
26        - Node
27    preconditions:
28    - key: "{{request.operation}}"
29      operator: Equals
30      value: UPDATE
31    - key: "{{request.object.metadata.labels.foo}}"
32      operator: Equals
33      value: "*"
34    validate:
35      message: "Setting the `foo` label on a Node is not allowed."
36      deny: {}
37