apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata:
  name: require-vso-secret-labels
  annotations:
    policies.kyverno.io/title: Require VSO ownership labels on VSO Secrets
    policies.kyverno.io/category: Secrets
    policies.kyverno.io/severity: medium
    policies.kyverno.io/description: >-
      Secrets that carry secrets.hashicorp.com/vso-ownerRefUID must also set
      app.kubernetes.io/managed-by=hashicorp-vso so ownership stays consistent.
spec:
  validationFailureAction: Audit
  background: true
  rules:
    - name: vso-owner-implies-managed-by
      match:
        any:
          - resources:
              kinds:
                - Secret
      preconditions:
        all:
          - key: "{{ request.object.metadata.labels.\"secrets.hashicorp.com/vso-ownerRefUID\" || '' }}"
            operator: NotEquals
            value: ""
      validate:
        message: >-
          Secrets with secrets.hashicorp.com/vso-ownerRefUID must set
          app.kubernetes.io/managed-by to hashicorp-vso.
        pattern:
          metadata:
            labels:
              app.kubernetes.io/managed-by: hashicorp-vso