apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: label-vso-upgrade-hook
spec:
  rules:
    - name: propagate-app-labels
      match:
        any:
          - resources:
              kinds:
                - Job
              names:
                - upgrade-crds-vault-secrets-operator
              namespaces:
                - vault
              annotations:
                helm.sh/hook: pre-upgrade
      mutate:
        patchStrategicMerge:
          spec:
            template:
              metadata:
                labels:
                  +(app.kubernetes.io/name): '{{ request.object.metadata.labels."app.kubernetes.io/name" }}'
                  +(app.kubernetes.io/instance): '{{ request.object.metadata.labels."app.kubernetes.io/instance" }}'