Restrict node label changes

 1apiVersion: kyverno.io/v1
 2kind: ClusterPolicy
 3metadata:
 4  name: protect-node-label-foo
 5  annotations:
 6    policies.kyverno.io/title: Restrict node label changes
 7    policies.kyverno.io/category: Sample
 8    policies.kyverno.io/subject: Node, Label
 9    policies.kyverno.io/minversion: 1.6.0
10    policies.kyverno.io/description: >-
11      Node labels are critical pieces of metadata upon which many other applications and
12      logic may depend and should not be altered or removed by regular users.
13      This policy prevents changes or deletions to a label called `foo` on
14      cluster Nodes. Use of this policy requires removal of the Node resource filter
15      in the Kyverno ConfigMap ([Node,*,*]). Due to Kubernetes CVE-2021-25735, this policy
16      requires, at minimum, one of the following versions of Kubernetes:
17      v1.18.18, v1.19.10, v1.20.6, or v1.21.0.      
18spec:
19  validationFailureAction: enforce
20  background: false
21  rules:
22  - name: prevent-label-value-changes
23    match:
24      any:
25      - resources:
26          kinds:
27          - Node
28    validate:
29      message: "Modifying the `foo` label on a Node is not allowed."
30      deny:
31        conditions:
32          all:
33          - key: "{{ request.object.metadata.labels.foo || '' }}"
34            operator: NotEquals
35            value: ""
36          - key: "{{ request.object.metadata.labels.foo || '' }}"
37            operator: NotEquals
38            value: "{{ request.oldObject.metadata.labels.foo || '' }}"
39  - name: prevent-label-key-removal
40    match:
41      any:
42      - resources:
43          kinds:
44          - Node
45    preconditions:
46      all:
47      - key: "{{ request.operation || 'BACKGROUND' }}"
48        operator: Equals
49        value: UPDATE
50      - key: "{{ request.oldObject.metadata.labels.foo || '' }}"
51        operator: Equals
52        value: "?*"
53    validate:
54      message: "Removing the `foo` label on a Node is not allowed."
55      pattern:
56        metadata:
57          labels:
58            foo: "*"